Malicious code in simple-date-formatter-new-9 (npm)
The npm package simple-date-formatter-new-9 contained malicious postinstall scripts that executed a reverse shell to 124.221.154.135:4444 and exfiltrated SSH directory contents during installation. The package was identified and reported by OpenSSF's malicious-packages project.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed simple-date-formatter-new-9 via npm
- Ecosystems
- Attack vectors
- Affected entities
- simple-date-formatter-new-9npm package containing malicious postinstall scripts
The npm package simple-date-formatter-new-9 was distributed with embedded malicious code designed to compromise systems during installation. The package.json declared a postinstall script that automatically opened an interactive bash reverse shell to the hardcoded remote address 124.221.154.135:4444, granting remote command execution to the attacker upon npm install.\n\nAdditionally, the tarball included a postinstall.js file that enumerated the installer's ~/.ssh directory and exfiltrated the file listing along with username and platform information via HTTP POST to https://124.221.154.135/post. Both attack mechanisms targeted the same hardcoded IP address and executed automatically during package installation.\n\nThe malicious package was identified and credited to the OpenSSF's malicious-packages project, which maintains a public catalog of confirmed malicious npm, PyPI, and other ecosystem packages.
Indicators of compromise
- Packages
- simple-date-formatter-new-9
- Domains
- 124.221.154.135
- IPs
- 124.221.154.135
Remediation
- Immediately uninstall simple-date-formatter-new-9 from all systems
- Audit npm install logs to identify when the package was installed
- Assume compromise of any system that installed this package; rotate SSH keys and credentials
- Review ~/.ssh directory access logs and SSH key usage for suspicious activity
- Monitor network traffic to/from 124.221.154.135 for data exfiltration
- Use npm audit to check for other malicious packages in your dependency tree
- Consider using npm package signing verification and private registry mirrors to prevent installation of malicious packages
Sources
- GitHub Advisory GHSA-fq7m-frv3-2w4v · GitHub Advisory Database
Cite this entry
"Malicious code in simple-date-formatter-new-9 (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 10, 2026; last updated August 10, 2026. https://supplychainattack.org/incident/malicious-code-in-simple-date-formatter-new-9-npm-1vsicx
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in @wololasod/tiny-id (npm)
The npm package @wololasod/tiny-id contained obfuscated malicious code that downloads and executes platform-specific remote executables on Windows and Linux systems. The dropper was embedded in both the main entry point (dist/index.cjs) and the TypeScript types file (dist/index.d.ts), disguised as a tiny ID generator.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in akamai-sensor (npm)
A malicious npm package named akamai-sensor impersonated Akamai's legitimate sensor_data anti-bot SDK. The package contained hidden JavaScript code concealed using invisible Unicode characters and implemented a dynamic command-and-control channel via a Google Calendar dead-drop, enabling arbitrary code execution on installation.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in upload-to-gcp (npm)
upload-to-gcp@3.2.1 (npm) contains malicious code in its postinstall script that exfiltrates host identifiers to an attacker-controlled endpoint. The package masquerades as a Google Cloud Platform utility but performs unauthorized telemetry collection at install time.
npmCompromised package - containedcritical
Malware in svelte-goal-vim
Malware was discovered in the npm package svelte-goal-vim. Systems with this package installed or running should be considered fully compromised and require immediate remediation.
npmCompromised package