OpenSSF/OSV advisory MAL-2026-11998 confirms this npm version as malicious. Package advertises itself as a date formatter utility but ships a malicious postinstall payload. package.json declares a postinstall lifecycle script that spawns an interactive bash reverse shell over /dev/tcp to 124.221.154.135:4444, giving a remote party command execution on the installer's host immediately after `npm install`. A bundled postinstall.js additionally enumerates the installer's ~/.ssh directory and...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in simple-date-formatter-util-7 (npm)
Details
Package advertises itself as a date formatter utility but ships a malicious postinstall payload. package.json declares a postinstall lifecycle script that spawns an interactive bash reverse shell over /dev/tcp to 124.221.154.135:4444, giving a remote party command execution on the installer's host immediately after `npm install`. A bundled postinstall.js additionally enumerates the installer's ~/.ssh directory and POSTs the listing along with username and platform metadata to the same host at 124.221.154.135 over HTTPS. Advertised purpose (date formatting) does not require network access, shell execution, or SSH directory reads.
Decision reason
OpenSSF Malicious Packages via OSV confirms simple-date-formatter-util-7@1.0.0 as malicious (MAL-2026-11998): Malicious code in simple-date-formatter-util-7 (npm)