simple-date-formatter-new-11

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (10e00618100992f74fd0b4c908be0db1c3e13de1b37ae9dc5952b7836f564042)
Package presents itself as a date-formatting utility but performs credential theft against the installer through two channels. The postinstall script in package.json curls cloud instance-metadata endpoints (Alibaba 100.100.100.200, AWS 169.254.169.254, and Tencent Cloud) and a /data/ listing, writes them to /tmp, and POSTs the concatenated contents to an attacker-controlled OAST collector at pdxkwzizhzzdpzpgcieqk6d1v7ynqsgfo.oast.fun/metadata — harvesting cloud IAM/instance credentials from any cloud VM or CI runner that installs the package. Separately, index.js (the package main) enumerates ~/.ssh on require, packages the username, platform, and key filenames as JSON, and POSTs the payload over HTTPS to the hardcoded remote host 124.221.154.135:443/post, so importing the module leaks SSH key metadata to a fixed attacker endpoint. The advertised formatDate functionality is a stub unrelated to the exfiltration paths.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/70a54c64ed12966f820d7ef17b912c81c4a2d56d/osv/malicious/npm/simple-date-formatter-new-11/MAL-2026-17158.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/70a54c64ed12966f820d7ef17b912c81c4a2d56d/osv/malicious/npm/simple-date-formatter-new-11/MAL-2026-17158.json
- https://www.npmjs.com/package/simple-date-formatter-new-11/v/1.0.0
- https://github.com/advisories/GHSA-2v58-3f75-j4jv

Compromised versions (1)

• = 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.