date-fns-sync

GHSA-695p-45c4-jxxh

Malicious code in date-fns-sync (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (8de9cc36a8817e94d67a46762e62e00a58e17077691ea1b4f649bc1f0d49e967)
package.json declares scripts.postinstall = 'node index.js'. index.js reconstructs a URL from a String.fromCharCode integer array — decoding to https://kongregate-api-config.vercel.app/ — fetches JSON from that endpoint, and passes the returned 'token' field directly to eval(). This executes attacker-controlled JavaScript on the installer's machine at npm install time. The destination is not a package publisher domain, the fetched payload is opaque and mutable, and the URL is deliberately concealed via char-code assembly to evade static analysis. The package's README describes it as a caching module, which does not match the observed behavior.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/e4956292c0cf024519ebae88e8b315a0af37a829/osv/malicious/npm/date-fns-sync/MAL-2026-15551.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/e4956292c0cf024519ebae88e8b315a0af37a829/osv/malicious/npm/date-fns-sync/MAL-2026-15551.json
- https://www.npmjs.com/package/date-fns-sync/v/1.0.0
- https://github.com/advisories/GHSA-695p-45c4-jxxh

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.