simple-date-formatter-new-8@1.0.0
Malicious code in simple-date-formatter-new-8 (npm)
T1195.002 · Compromise Software Supply ChainT1059.004 · Unix ShellT1082 · System Information DiscoveryT1046 · Network Service DiscoveryT1071.001 · Web ProtocolsT1041 · Exfiltration Over C2 Channel
Analysis
A combosquat date-formatter package with a postinstall hook that performs Kubernetes cluster reconnaissance and exfiltrates results. On install, the hook collects kernel version, hostname, DNS config, and routing table; probes internal IPs (10[.]45[.]196[.]138, .29, .4, .26) on K8s API ports 8080/6443; queries /version and /api/v1/namespaces on discovered API servers; then POSTs all collected data to safjhdvsfwzhieemkdzbgr54r0yjhrmok[.]oast[.]fun/escinfoF via curl.
- analyzed by
- Leitwacht
- first seen
- Aug 3, 2026, 05:22 PM
- analyzed
- Aug 3, 2026, 05:23 PM
Related advisories
- simple-date-formatter-new-6@1.0.0
- simple-date-formatter-new-5@1.0.0
- n8n-nodes-http-probe@1.0.0
- n8n-nodes-probe@1.0.0
- n8n-nodes-api-finder@1.0.0
- n8n-nodes-port-scanner@1.0.0
- n8n-nodes-net-utils@1.0.0
- n8n-nodes-utils-helper@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.