simple-date-formatter-new-7 @1.0.0
Vulnerability report · Last retrieved from osv.dev August 5, 2026 at 5:03 PM UTC
OSV ID
MAL-2026-12198
Ecosystem
npm
Summary
Package is advertised as a date-formatting utility but its postinstall script probes an internal-range Kubernetes API (10.45.196.138:8080, endpoints /version, /api, /api/v1/namespaces, /api/v1/pods, /api/v1/secrets, /api/v1/nodes plus two adjacent hosts) and POSTs the concatenated responses to an out-of-band collector at safjhdvsfwzhieemkdzbgr54r0yjhrmok.oast.fun/escinfo11. Runs automatically on npm install . The tarball also ships a postinstall.js containing a getSSHKeys() function that enumerates ~/.ssh and POSTs a JSON payload with the directory listing, username, and platform to a hardcoded remote IP 124.221.154.135:443/post over HTTPS. The advertised purpose ( formatDate() in index.js) is a thin cover story unrelated to the shipped install-time behavior.
Source: amazon-inspector (a09ab26676285be9c12d5c7ecfef65a0f0ebf32cb0324a83d3249c28674a1824)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.