NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
Malicious package

simple-date-formatter-util-6npm

Advisory published Updated

simple-date-formatter-util-6 is a confirmed malicious npm package (MAL-2026-11546) that opens a backdoor for remote access (malicious version 1.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in simple-date-formatter-util-6 (npm)

MAL-2026-11546
Immediate action
Remove the package, then rotate any secrets the build/runtime could reach.
npm uninstall simple-date-formatter-util-6

What this malware does

Package advertises a trivial formatDate utility but ships a malicious npm postinstall hook. The postinstall script launches a backgrounded interactive bash reverse shell via /dev/tcp/124.221.154.135/4444, granting a remote party shell access on the installer's host at install time. A companion postinstall.js reads the installer's ~/.ssh directory listing along with OS username/platform information and POSTs it over HTTPS to the same hardcoded IP (124.221.154.135:443, path /post). The advertised formatDate export in index.js is a decoy; the package name pattern and empty author metadata are consistent with a typosquat/decoy lure whose sole functional effect is install-time compromise of the installer machine.

Malicious versions

1 flagged
1.0.0

Indicators of compromise (SHA-256)

e3c4633742f36d29ca968a2ce71c97cb81e9cb2d2c76738742bb39de671cb115

Detection & response playbook

Backdoor / remote access

  1. Find it

    Search your lockfiles and build artifacts for simple-date-formatter-util-6 (version 1.0.0).

  2. If you installed it — respond

    simple-date-formatter-util-6 establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.

  3. Did it already run?

    If simple-date-formatter-util-6 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. simple-date-formatter-util-6 on npm has been identified as a malicious package (version 1.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-011340

References

Credits

  • Amazon Inspector · finder

Detect & block this

O3 blocks simple-date-formatter-util-6-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database
simple-date-formatter-util-6 (npm) malicious package — MAL-2026-11546 | O3 Security