simple-date-formatter-new-15@1.0.0
Malicious code in simple-date-formatter-new-15 (npm)
Analysis
The postinstall hook harvests cloud instance metadata and exfiltrates it. It curls the AWS/Aliyun metadata endpoint 169[.]254[.]169[.]254 (including /latest/meta-data/sts-credential), the Tencent Cloud endpoint metadata[.]tencentyun[.]com, and 169[.]254[.]0[.]23, saving each response to /tmp files, then POSTs the concatenated metadata to hxxp://YOUR_BURP_SERVER/metadata. It also runs `ls -la /data/` and POSTs the directory listing to hxxp://YOUR_BURP_SERVER/data. This steals cloud instance credentials (STS tokens) and filesystem data from any environment where the package is installed.
- analyzed by
- Leitwacht
- first seen
- Sep 24, 2026, 06:41 AM
- analyzed
- Sep 24, 2026, 06:42 AM
Related advisories
- @nimbusedge2/authxsas1@1.1.0
- @nimbusedge2/authxsas@1.1.0
- @dbbhk/ui-components@99.0.0
- @evial/init-helper-djkwt@1.0.0
- fmt-util-k7x2@1.0.0
- simple-date-formatter-util-11@1.0.0
- simple-date-formatter-util-4@1.0.0
- string-formatter-pro@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.