simple-date-formatter-new-9
A new date formatting utilit1
This report shows the evidence for simple-date-formatter-new-9@1.0.0, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe manifest directly defines an unconsented install-time reverse shell to a fixed external IP. The unused bundled reconnaissance/exfiltration script corroborates the malicious purpose.
Decision evidence
public snapshot- package.json postinstall opens an interactive shell to 124.221.154.135:4444.
- postinstall.js enumerates ~/.ssh public-key filenames and host/user identity.
- postinstall.js POSTs collected data to 124.221.154.135 over HTTPS.
- index.js is a simple local date-formatting export.
- postinstall.js is not the manifest lifecycle command.
Source & flagged code
4 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource collects local host identity data and sends it to an external endpoint.
postinstall.jsFindings
Affected versions and remediation
This report applies to simple-date-formatter-new-9@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing simple-date-formatter-new-9@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.