simple-date-formatter-new-14

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (cbe2adf4e9d3b54b33c0e80285a5b0eb4d81dfde75c7a5b7a202ac43793268cd)
The package presents itself as a date-formatting utility (index.js is a 160-byte formatDate stub) but the published tarball contains an SSH-key exfiltration payload and an install-time DNS beacon. package.json declares a postinstall lifecycle script that runs 'nslookup 9e954818.log.dnslogs.dpdns.org', causing every installer to beacon a per-package token to attacker-controlled DNS logging infrastructure at install time, leaking installer presence and resolver IP. A sibling postinstall.js reads ~/.ssh (enumerating.pub files and related host/user identifiers) and POSTs the collected data over HTTPS to a hardcoded bare IP endpoint at https://124.221.154.135/post; comments in the file describe SSH key theft and C2 exfiltration. The name-collision between the declared postinstall hook and the stealer filename, combined with the empty author field and typosquat-style package name, is consistent with a disposable supply-chain payload.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/70a54c64ed12966f820d7ef17b912c81c4a2d56d/osv/malicious/npm/simple-date-formatter-new-14/MAL-2026-17160.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/70a54c64ed12966f820d7ef17b912c81c4a2d56d/osv/malicious/npm/simple-date-formatter-new-14/MAL-2026-17160.json
- https://www.npmjs.com/package/simple-date-formatter-new-14/v/1.0.0
- https://github.com/advisories/GHSA-7r88-5m7v-8m5w

Compromised versions (1)

• = 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.