simple-date-formatter-new-15

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (005b96d3c3d5f1a071c40a8b72ea22b5e0221db32cfffacfc8f2343f0ee97eb0)
The package's package.json postinstall script curls cloud instance-metadata endpoints (AWS IMDS at 169.254.169.254/latest/meta-data/sts-credential, Alibaba/Tencent metadata at metadata.tencentyun.com and 169.254.0.23) into /tmp files and POSTs their concatenated contents plus `ls -la /data/` output to a remote collector (placeholder host YOUR_BURP_SERVER). The tarball additionally ships postinstall.js containing getSSHKeys(), which reads ~/.ssh from the installer's home directory along with username/platform metadata and POSTs the payload over HTTPS to a hardcoded bare IP 124.221.154.135:443/post. Installing the package runs the lifecycle exfiltration automatically; the SSH-key harvester is bundled dropper code aligned with the same intent. The trivial 'date formatter' name and the presence of a placeholder collector indicate a PoC/typosquat stub in an ongoing credential-theft campaign.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/70a54c64ed12966f820d7ef17b912c81c4a2d56d/osv/malicious/npm/simple-date-formatter-new-15/MAL-2026-17161.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/70a54c64ed12966f820d7ef17b912c81c4a2d56d/osv/malicious/npm/simple-date-formatter-new-15/MAL-2026-17161.json
- https://www.npmjs.com/package/simple-date-formatter-new-15/v/1.0.0
- https://github.com/advisories/GHSA-fj2x-7537-68xm

Compromised versions (1)

• = 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.