Malicious code in simple-date-formatter-new-11 (npm)

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (10e00618100992f74fd0b4c908be0db1c3e13de1b37ae9dc5952b7836f564042) Package presents itself as a date-formatting utility but performs credential theft against the installer through two channels. The postinstall script in package.json curls cloud instance-metadata endpoints (Alibaba 100.100.100.200, AWS 169.254.169.254, and Tencent Cloud) and a /data/ listing, writes them to /tmp, and POSTs the concatenated contents to an attacker-controlled OAST collector at pdxkwzizhzzdpzpgcieqk6d1v7ynqsgfo.oast.fun/metadata — harvesting cloud IAM/instance credentials from any cloud VM or CI runner that installs the package. Separately, index.js (the package main) enumerates ~/.ssh on require, packages the username, platform, and key filenames as JSON, and POSTs the payload over HTTPS to the hardcoded remote host 124.221.154.135:443/post, so importing the module leaks SSH key metadata to a fixed attacker endpoint. The advertised formatDate functionality is a stub unrelated to the exfiltration paths.

Source published

24 Sep 2026 13:16:23 UTC

Source modified

24 Sep 2026 13:30:04 UTC

Saved here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.