{"answers":{"affected":"1 open source package ship an affected version, including simple-date-formatter-new-2.","exploited":"There is no known exploitation of MAL-2026-12194 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-12194 is a malicious package in simple-date-formatter-new-2, published on 5 Aug 2026."},"fix_prompt":"MAL-2026-12194 is a malicious package: simple-date-formatter-new-2 (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-12194/ (Markdown: https://insights.sbomify.com/MAL-2026-12194/index.md)","id":"MAL-2026-12194","markdown":"https://insights.sbomify.com/MAL-2026-12194/index.md","name":"MAL-2026-12194","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The package presents itself as a trivial date-formatting utility (index.js exports a one-line wrapper around toLocaleDateString), but its package.json postinstall script runs a shell pipeline that probes sandbox and host state (tmpfs mount capability, bind-mount of /home/work, /proc/self/attr/current, LSM/AppArmor info, cgroups layout, /proc/partitions, and a listing of /home/work) and POSTs the combined output via curl to http://safjhdvsfwzhieemkdzbgr54r0yjhrmok.oast.fun/escinfo6, an interactsh/OAST out-of-band callback domain. The tarball additionally ships postinstall.js, which reads the installer's ~/.ssh directory, packages the filenames together with the local username and platform, and POSTs the JSON over HTTPS to the hardcoded IP 124.221.154.135:443/post; Chinese-language comments in that file describe stealing SSH keys and sending them to a C2. The benign facade contradicts the install-time behavior and the shipped stealer module.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in simple-date-formatter-new-2 (npm)","id":"MAL-2026-12194","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"simple-date-formatter-new-2","purl":"pkg:npm/simple-date-formatter-new-2","source":"MAL-2026-12194"}],"products":null,"published":"2026-08-05","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-12194/"}