Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Malicious code in date-sanitize-helper (npm)

The npm package 'date-sanitize-helper' version 1.0.0 was identified as malicious by the OpenSSF Package Analysis project. The package communicates with a domain associated with malicious activity and executes commands associated with malicious behavior.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Unknown; depends on adoption of malicious version 1.0.0
Ecosystems
npm
Attack vectors
Compromised package
Affected entities
  • date-sanitize-helper · 1.0.0

The OpenSSF Package Analysis project identified 'date-sanitize-helper' version 1.0.0 on npm as a malicious package. Analysis revealed two key indicators of compromise: the package communicates with a domain associated with malicious activity, and it executes one or more commands associated with malicious behavior.\n\nThe malicious package was cataloged in the OpenSSF's malicious-packages repository under identifier MAL-2026-11106. This discovery was made through automated analysis of package behavior and network communications.\n\nUsers who have installed version 1.0.0 of date-sanitize-helper should immediately remove the package and audit their systems for any unauthorized activity or data exfiltration.

Indicators of compromise

Packages
  • date-sanitize-helper@1.0.0

Remediation

  • Immediately uninstall date-sanitize-helper version 1.0.0 from all affected systems
  • Audit package.json and lock files to identify all installations of the malicious version
  • Review system logs and network traffic for signs of unauthorized command execution or data exfiltration
  • Consider using an alternative date sanitization library from a trusted source
  • Monitor npm registry for any patched or replacement versions from legitimate maintainers

Sources

  1. GitHub Advisory GHSA-jj2h-2x77-rrwf · GitHub Advisory Database

Cite this entry

"Malicious code in date-sanitize-helper (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 28, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-date-sanitize-helper-npm-gcn1za

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. activecritical

    Malware in @omniwatch-wick/cli

    Malware discovered in the npm package @omniwatch-wick/cli. Systems with this package installed are considered fully compromised and require immediate remediation.

    npmCompromised package
  2. activecritical

    Malware in chain-manager

    Malware discovered in the npm package chain-manager. Systems with this package installed or running are considered fully compromised and require immediate remediation.

    npmCompromised package
  3. containedcritical

    Malicious code in toll_free (npm)

    The npm package toll_free version 1.0.1 was identified as malicious by the OpenSSF Package Analysis project. The package executes commands associated with malicious behavior.

    npmCompromised package
  4. containedcritical

    Malicious code in blots (npm)

    The npm package 'blots' version 2.1.0 was identified by the OpenSSF Package Analysis project as containing malicious code that executes commands associated with malicious behavior. The package has been flagged in the OpenSSF malicious packages database.

    npmCompromised package