Malicious code in simple-date-formatter-new-9 (npm)
The npm package 'simple-date-formatter-new-9' version 1.0.0 contains malicious code that executes a reverse shell to a hardcoded remote IP address during installation. It also collects and exfiltrates the installer's ~/.ssh directory listing along with username and platform information to the same remote server. This behavior occurs automatically during the npm install process, enabling remote command execution on the installer's host.
AI Analysis
Technical Summary
The 'simple-date-formatter-new-9' npm package version 1.0.0 includes a postinstall script that opens an interactive bash reverse shell to the hardcoded IP 124.221.154.135 on port 4444 during npm install, granting remote command execution to the attacker. Additionally, the package contains a postinstall.js script that enumerates the installer's ~/.ssh directory and sends the file listing, username, and platform information via HTTP POST to https://124.221.154.135/post. Both malicious components target the same IP address and activate automatically during installation, compromising the installer's system.
Potential Impact
Successful installation of this package version results in the attacker's ability to execute arbitrary commands remotely on the victim's machine via the reverse shell. Sensitive information about the victim's SSH configuration and environment is also exfiltrated, potentially enabling further compromise or lateral movement.
Mitigation Recommendations
No official patch or remediation is currently available for this malicious package. Users should avoid installing 'simple-date-formatter-new-9' version 1.0.0 and remove it if already installed. Verify package authenticity before installation and prefer trusted sources. Monitor for any unexpected network connections to the IP 124.221.154.135 and investigate any suspicious activity.
Malicious code in simple-date-formatter-new-9 (npm)
Description
The npm package 'simple-date-formatter-new-9' version 1.0.0 contains malicious code that executes a reverse shell to a hardcoded remote IP address during installation. It also collects and exfiltrates the installer's ~/.ssh directory listing along with username and platform information to the same remote server. This behavior occurs automatically during the npm install process, enabling remote command execution on the installer's host.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'simple-date-formatter-new-9' npm package version 1.0.0 includes a postinstall script that opens an interactive bash reverse shell to the hardcoded IP 124.221.154.135 on port 4444 during npm install, granting remote command execution to the attacker. Additionally, the package contains a postinstall.js script that enumerates the installer's ~/.ssh directory and sends the file listing, username, and platform information via HTTP POST to https://124.221.154.135/post. Both malicious components target the same IP address and activate automatically during installation, compromising the installer's system.
Potential Impact
Successful installation of this package version results in the attacker's ability to execute arbitrary commands remotely on the victim's machine via the reverse shell. Sensitive information about the victim's SSH configuration and environment is also exfiltrated, potentially enabling further compromise or lateral movement.
Mitigation Recommendations
No official patch or remediation is currently available for this malicious package. Users should avoid installing 'simple-date-formatter-new-9' version 1.0.0 and remove it if already installed. Verify package authenticity before installation and prefer trusted sources. Monitor for any unexpected network connections to the IP 124.221.154.135 and investigate any suspicious activity.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13698
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a79f0dcbf8831d539f61b14
Added to database: 08/10/2026, 15:40:12 UTC
Last enriched: 08/10/2026, 15:59:15 UTC
Last updated: 08/10/2026, 15:59:15 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.