format-helper-lib@1.0.0
Malicious code in format-helper-lib (npm)
Analysis
The package is named and described as a benign date/number formatting helper, but its postinstall hook (install-cb.js) runs a container-escape reconnaissance probe. On install it fingerprints the host and container runtime (hostname, OS release, kernel cmdline, runc/containerd/cri-o/docker versions), enumerates security posture (seccomp, AppArmor, SELinux, process capabilities, UID/GID maps, namespace links, /dev), checks for container runtime sockets, tests NFS root-squash, and probes NFS server ports 111 and 2049 on 10[.]0[.]128[.]136. Collected results are written to NCODE_RUNTIME.txt and NCODE_POC_MARKER.txt in the install directory and its parents.
- analyzed by
- Leitwacht
- first seen
- Aug 7, 2026, 04:17 AM
- analyzed
- Aug 7, 2026, 04:19 AM
Related advisories
- simple-date-formatter-new-5@1.0.0
- simple-date-formatter-new-2@1.0.0
- simple-date-formatter-new-1@1.0.0
- simple-date-formatter-util-13@1.0.0
- simple-date-formatter-util-11@1.0.0
- simple-date-formatter-util-12@1.0.0
- num-format-helper@1.0.0
- chart-data-utils@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.