OpenSSF/OSV advisory MAL-2026-12225 confirms this npm version as malicious. The package advertises itself as a time-formatting utility (index.js exports formatDate/capitalize/truncate) but ships a postinstall.js lifecycle script that runs on npm install and performs unrelated cloud credential harvesting. postinstall.js uses child_process.exec to shell out to curl against multi-cloud instance metadata services (AWS 169.254.169.254, Aliyun 100.100.100.200, Tencent metadata.tencentyun.com, GCP...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in time-utils-helper (npm)
Details
The package advertises itself as a time-formatting utility (index.js exports formatDate/capitalize/truncate) but ships a postinstall.js lifecycle script that runs on npm install and performs unrelated cloud credential harvesting. postinstall.js uses child_process.exec to shell out to curl against multi-cloud instance metadata services (AWS 169.254.169.254, Aliyun 100.100.100.200, Tencent metadata.tencentyun.com, GCP metadata.google.internal, Azure), extracts AWS IAM security credentials for the instance role into /tmp/.iam-creds, and transmits hostname, user, and the IAM credential material as HTTP GET query-string parameters to the hardcoded Burp Collaborator subdomain pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com. The mismatch between the declared trivial utility purpose and the install-time cloud-metadata scraping identifies the package as a decoy delivery vehicle for credential theft.
Decision reason
OpenSSF Malicious Packages via OSV confirms time-utils-helper@1.0.0 as malicious (MAL-2026-12225): Malicious code in time-utils-helper (npm)