datefmt-simple-utils (npm) · Malicious Code
Affects datefmt-simple-utilsSource GCVE Database
Malicious package : remove datefmt-simple-utils and rotate any secrets on hosts that installed it.
Data as of 14 Aug 2026, 16:52 UTC
Malicious package
Published to npm · OSV MAL-2026-14032
What to do
Remove datefmt-simple-utils from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmdatefmt-simple-utils | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package datefmt-simple-utils version 1.0.0 is a malicious package masquerading as a date-formatting utility. During installation, it executes a postinstall script that opens a TCP connection to a hardcoded remote host and attaches an interactive shell, allowing remote command execution on the installer's machine. The package does not provide any legitimate date-formatting functionality and uses multiple fallback methods to establish the reverse shell.