Which versions of time-format-kit are malicious?

The following npm versions of time-format-kit are flagged malicious: 1.0.0, 1.0.1, 1.0.2. Treat any of these as compromised.

How do I remediate time-format-kit if I installed it?

time-format-kit is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed time-format-kit — how do I know if it already compromised me?

If time-format-kit was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is time-format-kit part of a known attack campaign?

Yes — time-format-kit is associated with the IN-MAL-2026-010690, IN-MAL-2026-010694, IN-MAL-2026-010696 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find time-format-kit across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for time-format-kit (3 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging time-format-kit across your stack and pipelines.

Malicious package

time-format-kitnpm

time-format-kit is a confirmed malicious npm package (MAL-2026-10700) that steals credentials and exfiltrates sensitive data (malicious versions 1.0.0, 1.0.1, 1.0.2). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in time-format-kit (npm)

MAL-2026-10700

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall time-format-kit

What this malware does

On npm install, the package's postinstall script decodes base64-encoded shell payloads and executes them via an obfuscated child_process.exec lookup (require('ch'+'il'+'d_p'+'rocess')['e'+'xec']). The shell payload reads ~/.aws/credentials, ~/.ssh/id_rsa, ~/.ssh/authorized_keys, ~/.ssh/known_hosts, ~/.bash_history, the full process environment, and host identifiers (hostname, whoami, id, sudo -l), then POSTs the base64-encoded contents over plain HTTP to a hardcoded Burp Collaborator subdomain at pwpzhsrbtvmfqrqr7onqcwnrcii960up.oastify.com. Additional payloads issue curl requests through the installer host to http://tst.woa.com/flag.html and http://tst.woa.com/ssrf_forward.php with an oastify-subdomain host parameter, and POST the response bodies back to the same collaborator endpoint, using the installer as an SSRF relay. The package name ('time-format-kit') has no functional relationship to the observed behavior.

The OpenSSF Package Analysis project identified 'time-format-kit' @ 1.0.2 (npm) as malicious.

It is considered malicious because:

The package communicates with a domain associated with malicious activity.
The package executes one or more commands associated with malicious behavior.

Malicious versions

3 flagged

1.0.01.0.11.0.2

Indicators of compromise (SHA-256)

013929714a8a46ad664ac923c9ce315df1b9351993cc7d2d06a325d8f0c49009

720cc381014fc2e82f745dc2709b894652cd25e1ee4889e6798d05a598b19623

d50a73d9427a1765efc9ef52755ba856343a936a0fd349c83030bebb76870041

168d334d742003cf94d8b87ba56cd72694081ade01f6814062e58ebdc47d8594

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for time-format-kit (3 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging time-format-kit across your stack and pipelines.
If you installed it — respond
time-format-kit is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If time-format-kit was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks time-format-kit before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. time-format-kit on npm has been identified as a malicious package (versions 1.0.0, 1.0.1, 1.0.2 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-010690IN-MAL-2026-010694IN-MAL-2026-010696

References

Credits

Amazon Inspector · finder
OpenSSF: Package Analysis · finder

Detect & block this

O3 blocks time-format-kit-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database