MAL-2026-11502 Malicious code in simple-date-formatter-new-1 (npm)

On npm install, the package.json postinstall hook executes a shell one-liner that attempts to mount the host block device via mknod, enumerates /etc/kubernetes and kubelet pod directories, reads the Kubernetes service-account token at /var/run/secrets/kubernetes.io/serviceaccount/token, lists home directory contents, and POSTs the collected output to http://safjhdvsfwzhieemkdzbgr54r0yjhrmok.oast.fun/escinfo4 (an interact.sh OAST callback subdomain). A sibling postinstall.js in the tarball reads the installer's ~/.ssh directory via getSSHKeys() and POSTs a JSON payload containing SSH contents, username, and platform to hardcoded IP 124.221.154.135 on port 443. The package advertises itself as a date formatter but ships no such functionality; its only effect on install is host reconnaissance and credential exfiltration.

The OpenSSF Package Analysis project identified 'simple-date-formatter-new-1' @ 1.0.0 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.

• The package executes one or more commands associated with malicious behavior.