MAL-2026-17161

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/simple-date-formatter-new-15/MAL-2026-17161.json
JSON Data
https://api.test.osv.dev/v1/vulns/MAL-2026-17161
Published
2026-09-24T13:16:33Z
Modified
2026-09-24T13:30:05Z
Summary
Malicious code in simple-date-formatter-new-15 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (005b96d3c3d5f1a071c40a8b72ea22b5e0221db32cfffacfc8f2343f0ee97eb0)

The package's package.json postinstall script curls cloud instance-metadata endpoints (AWS IMDS at 169.254.169.254/latest/meta-data/sts-credential, Alibaba/Tencent metadata at metadata.tencentyun.com and 169.254.0.23) into /tmp files and POSTs their concatenated contents plus ls -la /data/ output to a remote collector (placeholder host YOUR_BURP_SERVER). The tarball additionally ships postinstall.js containing getSSHKeys(), which reads ~/.ssh from the installer's home directory along with username/platform metadata and POSTs the payload over HTTPS to a hardcoded bare IP 124.221.154.135:443/post. Installing the package runs the lifecycle exfiltration automatically; the SSH-key harvester is bundled dropper code aligned with the same intent. The trivial 'date formatter' name and the presence of a placeholder collector indicate a PoC/typosquat stub in an ongoing credential-theft campaign.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020506",
            "import_time":  "2026-09-24T13:18:04.389484288Z",
            "modified_time":  "2026-09-24T13:16:33Z",
            "sha256":  "005b96d3c3d5f1a071c40a8b72ea22b5e0221db32cfffacfc8f2343f0ee97eb0",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / simple-date-formatter-new-15

Package

Name
simple-date-formatter-new-15
View open source insights on deps.dev
Purl
pkg:npm/simple-date-formatter-new-15

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "package.json",
            "sha256":  "22f579f6a663f550778e306a146c61583c10f45bb70b267fb898a28fa8c1a54e",
            "tlsh":  "f601ce98b651a9730fc68b79d26a030aa510fd471ac07e0992961cf84ece9b1a17c70d"
        },
        {
            "path":  "postinstall.js",
            "sha256":  "f2be6940c08d36a7f1ce83d5fe16fefd8c14edda5d124e0f6406725beb5020ef",
            "tlsh":  "273165d558f9cd3007778685639b91263102fe13650ee940f3c807a51fe9a5449f2dee"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "simple-date-formatter-new-15-1.0.0.tgz",
            "hashes":  {
                "sha1":  "c2f40d1a905a456ff741306488cca524020a4df3",
                "sha512_sri":  "sha512-//gaNGAaREIYH7EdTHTEIYfsiO0cIT/cDx/eqfzv8mIEsg6Rr7Oe52ZZe0k/3mPWNZYTUtFveI4EX6epbnBwdw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/simple-date-formatter-new-15/MAL-2026-17161.json"