simple-date-formatter-new-14@1.0.0
Malicious code in simple-date-formatter-new-14 (npm)
T1059.007 · JavaScriptT1082 · System Information DiscoveryT1005 · Data from Local SystemT1071.001 · Web ProtocolsT1041 · Exfiltration Over C2 Channel
Analysis
The postinstall hook of this package (a fake date-formatting utility) runs `nslookup 9e954818[.]log[.]dnslogs[.]dpdns[.]org` as a DNS beacon and executes postinstall.js, which enumerates the user's ~/.ssh directory for public keys, collects the OS username and platform, and POSTs this data as JSON to hxxps://124[.]221[.]154[.]135:443/post. The package also ships .claude/settings.local.json granting PowerShell(npm config *) permission. It exfiltrates host identity and SSH key presence to a hardcoded C2 IP on install.
- analyzed by
- Leitwacht
- first seen
- Sep 24, 2026, 06:19 AM
- analyzed
- Sep 24, 2026, 06:20 AM
Related advisories
- cisco-github-simple@1.0.1
- take-home-caller-id@1.0.1
- pflag14570@1.0.0
- ragacateslikodi@1.0.1
- discord-resolvers@3.4.2
- discord-players@3.4.2
- tracker-cloudflare@1.0.0
- real-router-telemetry@1.0.1
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.