Malicious code in datefmt-helper (npm)
The npm package `datefmt-helper` is a supply-chain dropper disguised as a benign date-formatting utility (its `description` reads "dates formatting utility with locale support"). The package ships no source repository and places its real behaviour in an install script. A `postinstall` lifecycle hook (`postinstall: node postinstall.js`) executes automatically on `npm install`, before the package is ever imported. The install script uses HTTP / `curl` / `wget` primitives to download a second-stage payload from the hardcoded external IP `115.190.124.243`, then executes it via a Node child process — the classic download-and-execute pattern. Any developer workstation or CI runner that installs the package (directly or transitively) hands arbitrary code execution to the operator of that endpoint. Detected and classified independently by codelake Research from the live npm feed on 2026-07-02; at the time of reporting the package was not present in OSV or GHSA (a first-catch). --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (d92b853245953aa75db608f0ae2e5de2321301b94ca6b48f55746a1bd60b6ea4) On `npm install`, the package's postinstall script fetches an unauthenticated payload over plain HTTP from a hardcoded bare IP (115.190.124.243:8761) and executes it. On Unix, `curl`/`wget` output is piped directly to `sh`. On Windows, `certutil.exe -urlcache -split -f` downloads a batch file to C:\Users\Public\run.bat and executes it. The fetched content is unpinned, unverified, and mutable — the operator of the endpoint can serve arbitrary code at any time. The package advertises itself as a lightweight date formatter (`date-fns-lite` branding, impersonating the date-fns ecosystem), but the payload has no relationship to date formatting. The typosquat/impersonation branding combined with an install-time dropper is a supply-chain attack lure. ## Source: ghsa-malware (6c9b82c471edb6b2caeb78c78887556e4c313efc0ba29a88a482b0f93d378807) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
AI Analysis
Technical Summary
The 'datefmt-helper' npm package (versions 1.0.0 and 1.0.1) is a malicious package that uses its postinstall lifecycle hook to download and execute a second-stage payload from an unauthenticated HTTP source at IP 115.190.124.243:8761. On Unix systems, it uses curl or wget piped to sh; on Windows, it uses certutil to download and execute a batch file. This download-and-execute pattern occurs before the package is imported, enabling arbitrary code execution on any system that installs the package. The package disguises itself as a date formatting utility with locale support and mimics the date-fns ecosystem branding to deceive users. There is no source repository, and the payload is mutable and unverified, representing a classic supply-chain attack vector.
Potential Impact
Any system that installs the affected versions of 'datefmt-helper' (1.0.0 or 1.0.1) is at risk of arbitrary code execution due to the untrusted postinstall script. This can compromise developer machines, continuous integration environments, or any automated systems that perform npm installs involving this package. The attack enables the operator controlling the external IP to execute any code on the victim system with the privileges of the installing user.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance. Until an official fix or removal occurs, avoid installing or using the 'datefmt-helper' package, especially versions 1.0.0 and 1.0.1. Audit dependency trees to detect and remove this package if present. Consider using npm audit or supply-chain security tools to identify and block this malicious package.
Malicious code in datefmt-helper (npm)
Description
The npm package `datefmt-helper` is a supply-chain dropper disguised as a benign date-formatting utility (its `description` reads "dates formatting utility with locale support"). The package ships no source repository and places its real behaviour in an install script. A `postinstall` lifecycle hook (`postinstall: node postinstall.js`) executes automatically on `npm install`, before the package is ever imported. The install script uses HTTP / `curl` / `wget` primitives to download a second-stage payload from the hardcoded external IP `115.190.124.243`, then executes it via a Node child process — the classic download-and-execute pattern. Any developer workstation or CI runner that installs the package (directly or transitively) hands arbitrary code execution to the operator of that endpoint. Detected and classified independently by codelake Research from the live npm feed on 2026-07-02; at the time of reporting the package was not present in OSV or GHSA (a first-catch). --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (d92b853245953aa75db608f0ae2e5de2321301b94ca6b48f55746a1bd60b6ea4) On `npm install`, the package's postinstall script fetches an unauthenticated payload over plain HTTP from a hardcoded bare IP (115.190.124.243:8761) and executes it. On Unix, `curl`/`wget` output is piped directly to `sh`. On Windows, `certutil.exe -urlcache -split -f` downloads a batch file to C:\Users\Public\run.bat and executes it. The fetched content is unpinned, unverified, and mutable — the operator of the endpoint can serve arbitrary code at any time. The package advertises itself as a lightweight date formatter (`date-fns-lite` branding, impersonating the date-fns ecosystem), but the payload has no relationship to date formatting. The typosquat/impersonation branding combined with an install-time dropper is a supply-chain attack lure. ## Source: ghsa-malware (6c9b82c471edb6b2caeb78c78887556e4c313efc0ba29a88a482b0f93d378807) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'datefmt-helper' npm package (versions 1.0.0 and 1.0.1) is a malicious package that uses its postinstall lifecycle hook to download and execute a second-stage payload from an unauthenticated HTTP source at IP 115.190.124.243:8761. On Unix systems, it uses curl or wget piped to sh; on Windows, it uses certutil to download and execute a batch file. This download-and-execute pattern occurs before the package is imported, enabling arbitrary code execution on any system that installs the package. The package disguises itself as a date formatting utility with locale support and mimics the date-fns ecosystem branding to deceive users. There is no source repository, and the payload is mutable and unverified, representing a classic supply-chain attack vector.
Potential Impact
Any system that installs the affected versions of 'datefmt-helper' (1.0.0 or 1.0.1) is at risk of arbitrary code execution due to the untrusted postinstall script. This can compromise developer machines, continuous integration environments, or any automated systems that perform npm installs involving this package. The attack enables the operator controlling the external IP to execute any code on the victim system with the privileges of the installing user.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance. Until an official fix or removal occurs, avoid installing or using the 'datefmt-helper' package, especially versions 1.0.0 and 1.0.1. Audit dependency trees to detect and remove this package if present. Consider using npm audit or supply-chain security tools to identify and block this malicious package.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-6788
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a50ba9768715ace435825c3
Added to database: 07/10/2026, 09:25:43 UTC
Last enriched: 07/10/2026, 10:10:57 UTC
Last updated: 07/29/2026, 12:01:37 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.