{"id":"MAL-2026-12225","revision":"e76a4fd0eaef4beb9b658ea61aff37a0","records":[{"revision":"e76a4fd0eaef4beb9b658ea61aff37a0","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-12225","aliases":[],"title":"Malicious code in time-utils-helper (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (93cbd818e3b29b2b7c9da6f48b3d82baae1af9bd0fa637a2848749bdfea86084)\nThe package advertises itself as a time-formatting utility (index.js exports formatDate/capitalize/truncate) but ships a postinstall.js lifecycle script that runs on npm install and performs unrelated cloud credential harvesting. postinstall.js uses child_process.exec to shell out to curl against multi-cloud instance metadata services (AWS 169.254.169.254, Aliyun 100.100.100.200, Tencent metadata.tencentyun.com, GCP metadata.google.internal, Azure), extracts AWS IAM security credentials for the instance role into /tmp/.iam-creds, and transmits hostname, user, and the IAM credential material as HTTP GET query-string parameters to the hardcoded Burp Collaborator subdomain pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com. The mismatch between the declared trivial utility purpose and the install-time cloud-metadata scraping identifies the package as a decoy delivery vehicle for credential theft.\n","state":0,"publishedAt":"2026-08-05T09:18:14+00:00","modifiedAt":"2026-09-24T09:30:16.6252418+00:00","affected":[{"ecosystem":"npm","name":"time-utils-helper","ranges":[],"versions":["1.0.0"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/time-utils-helper/v/1.0.0"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-12225","license":"OSV · upstream source license applies","key":"osv:MAL-2026-12225","identifiers":["MAL-2026-12225"]},"retained":false,"historicalAffected":[]}],"coverage":[]}