Malicious code in time-utils-helper (npm)
Historical advisory saved 24 Oct 2026 13:17:17 UTC. The publisher may have updated it since then. Latest advisory.
osv · MAL-2026-12225
Published--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (93cbd818e3b29b2b7c9da6f48b3d82baae1af9bd0fa637a2848749bdfea86084) The package advertises itself as a time-formatting utility (index.js exports formatDate/capitalize/truncate) but ships a postinstall.js lifecycle script that runs on npm install and performs unrelated cloud credential harvesting. postinstall.js uses child_process.exec to shell out to curl against multi-cloud instance metadata services (AWS 169.254.169.254, Aliyun 100.100.100.200, Tencent metadata.tencentyun.com, GCP metadata.google.internal, Azure), extracts AWS IAM security credentials for the instance role into /tmp/.iam-creds, and transmits hostname, user, and the IAM credential material as HTTP GET query-string parameters to the hardcoded Burp Collaborator subdomain pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com. The mismatch between the declared trivial utility purpose and the install-time cloud-metadata scraping identifies the package as a decoy delivery vehicle for credential theft.
- Source published
- 5 Aug 2026 09:18:14 UTC
- Source modified
- 24 Sep 2026 09:30:16 UTC
- Saved here
- 24 Oct 2026 13:17:17 UTC
- Source terms
- OSV · upstream source license applies
Original source record · Cite this exact observation · Complete original publisher JSON
Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.