MAL-2026-17158

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/simple-date-formatter-new-11/MAL-2026-17158.json
JSON Data
https://api.test.osv.dev/v1/vulns/MAL-2026-17158
Published
2026-09-24T13:16:23Z
Modified
2026-09-24T13:30:05Z
Summary
Malicious code in simple-date-formatter-new-11 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (10e00618100992f74fd0b4c908be0db1c3e13de1b37ae9dc5952b7836f564042)

Package presents itself as a date-formatting utility but performs credential theft against the installer through two channels. The postinstall script in package.json curls cloud instance-metadata endpoints (Alibaba 100.100.100.200, AWS 169.254.169.254, and Tencent Cloud) and a /data/ listing, writes them to /tmp, and POSTs the concatenated contents to an attacker-controlled OAST collector at pdxkwzizhzzdpzpgcieqk6d1v7ynqsgfo.oast.fun/metadata — harvesting cloud IAM/instance credentials from any cloud VM or CI runner that installs the package. Separately, index.js (the package main) enumerates ~/.ssh on require, packages the username, platform, and key filenames as JSON, and POSTs the payload over HTTPS to the hardcoded remote host 124.221.154.135:443/post, so importing the module leaks SSH key metadata to a fixed attacker endpoint. The advertised formatDate functionality is a stub unrelated to the exfiltration paths.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020505",
            "import_time":  "2026-09-24T13:18:04.311547525Z",
            "modified_time":  "2026-09-24T13:16:23Z",
            "sha256":  "10e00618100992f74fd0b4c908be0db1c3e13de1b37ae9dc5952b7836f564042",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / simple-date-formatter-new-11

Package

Name
simple-date-formatter-new-11
View open source insights on deps.dev
Purl
pkg:npm/simple-date-formatter-new-11

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "package.json",
            "sha256":  "3487cd5e35dea398c05702c8eb92af3f3453bdae95288908bbe759353b38f04d",
            "tlsh":  "2001c2c8b651ad735fc29ab8d2a6070e6910fd471b807e05a3962cf44f8d9b1a07e70e"
        },
        {
            "path":  "index.js",
            "sha256":  "1d5404dbbd7f6a35142bc11e276bcff7b334f927a198399e6b0d9aa09ecfd098",
            "tlsh":  "8cc08c94a716b2866326122096a74100be5cc2300b9a6a62b88ec0c00144c12805ef8c"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "simple-date-formatter-new-11-1.0.0.tgz",
            "hashes":  {
                "sha1":  "648c565903ac3d6b3d7f5cbf4472950cf2fcba70",
                "sha512_sri":  "sha512-ZNWdXzoX9iAOsIEqAHFWoh0sriEHRCyRA09FTixKoEwSOd31o7TWjfXNkGG94B2r7IbXPPKipPwKtr8YMVHZgQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/simple-date-formatter-new-11/MAL-2026-17158.json"