Malicious code in datefmt-util-helper (npm)
The npm package datefmt-util-helper contained malicious code that executed a reverse shell during installation. The postinstall script established a connection to a remote VPS (8.135.48.40:4444) and granted the attacker interactive shell access on the installer's machine.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed datefmt-util-helper via npm
- Ecosystems
- Attack vectors
- Affected entities
- datefmt-util-helpernpm package containing malicious postinstall script
The npm package datefmt-util-helper was published with embedded malicious code disguised as a legitimate date-formatting utility. The package.json declared a postinstall script that executed arbitrary code during npm install.
The postinstall.js script hardcoded a connection to a remote VPS at IP 8.135.48.40 on port 4444. It attempted multiple methods to establish a reverse shell, including Python-based socket connections with pty.spawn('/bin/bash') and Node.js-based alternatives using child_process.spawn('/bin/bash'). This gave the remote attacker full interactive shell control on the installer's machine with the privileges of the installing user.
The index.js file contained a trivial date formatter implementation that served as cover for the malicious functionality. The library's legitimate surface was minimal, existing only to legitimize the package in the npm ecosystem.
The incident was identified and credited to the OpenSSF's malicious-packages repository, which tracks confirmed supply chain attacks.
Indicators of compromise
- Packages
- datefmt-util-helper
- IPs
- 8.135.48.40
Remediation
- Immediately uninstall datefmt-util-helper from all systems where it was installed
- Audit npm install logs to identify all machines that installed this package
- Assume any machine that installed this package has been compromised; perform full security audit and consider system rebuild
- Change all credentials and SSH keys on affected systems
- Monitor affected systems for signs of unauthorized access or data exfiltration
- Review npm audit logs and consider using npm package signing verification
- Use npm package integrity checking and consider restricting postinstall scripts via npm configuration
Sources
- GitHub Advisory GHSA-3w9h-7mv3-vfh5 · GitHub Advisory Database
Cite this entry
"Malicious code in datefmt-util-helper (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 13, 2026; last updated August 13, 2026. https://supplychainattack.org/incident/malicious-code-in-datefmt-util-helper-npm-vzmeck
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in epic-common (npm)
The npm package epic-common was found to contain malicious code. The package was identified by Amazon Inspector and reported through the OpenSSF malicious packages database.
npmCompromised package - resolvedcritical
Malicious code in epic-common-node (npm)
The npm package epic-common-node was found to contain malicious code. The package has been identified and reported through GitHub Security Advisory GHSA-m36g-mhjr-ww2c.
npmCompromised package - containedcritical
Malware in @siwatfa/yorn
Malware was discovered in the npm package @siwatfa/yorn. Systems with this package installed or running should be considered fully compromised, with all secrets and keys requiring immediate rotation from a different computer.
npmCompromised package - activecritical
Malware in @ai-vertical/ai-agent
Malware was discovered in the npm package @ai-vertical/ai-agent. Systems with this package installed or running should be considered fully compromised and require immediate remediation.
npmAI agents & skillsCompromised package