MAL-2026-17161 Malicious code in simple-date-formatter-new-15 (npm)
Malicious package
Published
MAL-2026-17161 is a malicious package: simple-date-formatter-new-15 (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-17161/ (Markdown: https://insights.sbomify.com/MAL-2026-17161/index.md)
- Package
- simple-date-formatter-new-15
- Registry
- npm
What is MAL-2026-17161?
MAL-2026-17161 is a malicious package in simple-date-formatter-new-15, published on 24 Sep 2026.
Official description
The package's package.json postinstall script curls cloud instance-metadata endpoints (AWS IMDS at 169.254.169.254/latest/meta-data/sts-credential, Alibaba/Tencent metadata at metadata.tencentyun.com and 169.254.0.23) into /tmp files and POSTs their concatenated contents plus
ls -la /data/ output to a remote collector (placeholder host YOUR_BURP_SERVER). The tarball additionally ships postinstall.js containing getSSHKeys(), which reads ~/.ssh from the installer's home directory along with username/platform metadata and POSTs the payload over HTTPS to a hardcoded bare IP 124.221.154.135:443/post. Installing the package runs the lifecycle exfiltration automatically; the SSH-key harvester is bundled dropper code aligned with the same intent. The trivial 'date formatter' name and the presence of a placeholder collector indicate a PoC/typosquat stub in an ongoing credential-theft campaign.What should I do about MAL-2026-17161?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.