Supply chain · npm · High

CRITICAL: Malicious 'datefmt-helper' npm package compromises systems

Threat Engine Auto-Feed · data current as of 2026-07-15

The 'datefmt-helper' npm package has been identified as malicious, leading to full system compromise upon installation. All secrets and keys on affected systems must be rotated immediately, and the package removed, though full remediation may require further action due to potential persistent compromise.

  • Package: npm / datefmt-helper
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~149/wk
  • Exposure: 70/100 (High)

What happened — Credential / secret theft

The 'datefmt-helper' npm package contains malware. Installation or execution of this package results in a complete compromise of the host system.

How the attack works

This is a malicious package attack where a seemingly benign software component is designed to execute unauthorized actions upon installation or use. Such attacks typically aim to establish persistence, exfiltrate sensitive data, or enable further malicious activity on the compromised system.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that automatically pull package dependencies
  • Any user or system that has installed 'datefmt-helper'

Conditions that increase exposure

  • Unpinned dependencies that allow automatic updates to malicious versions
  • Lack of package lockfiles (e.g., package-lock.json) to ensure consistent dependency versions
  • Use of internal package mirrors that do not vet upstream packages

Blast-radius scenarios

  • An attacker gains full control over the compromised system.
  • All secrets and keys stored on the compromised computer are exposed and potentially exfiltrated.
  • The compromised system could be used as a pivot point for further attacks within the network.

What to do (defensive)

Detect

  • Scan dependency trees for 'datefmt-helper' in any version.
  • Review package lockfiles and manifest files (e.g., package.json) for direct or transitive inclusion of 'datefmt-helper'.

Contain

  • Immediately isolate any system found to have 'datefmt-helper' installed or executed.
  • Block 'datefmt-helper' from being downloaded or installed in your environment.

Remediate

  • Consider any system with 'datefmt-helper' installed as fully compromised.
  • Rotate all secrets and keys (e.g., API keys, SSH keys, credentials) stored on affected systems from a different, trusted computer.
  • Remove the 'datefmt-helper' package from all affected systems. Be aware that full control may have been given to an outside entity, so further forensic analysis and re-imaging may be necessary to ensure complete remediation.

Frontier verdict — High

Prioritize immediate detection and isolation of 'datefmt-helper' installations, followed by comprehensive credential rotation and system remediation due to critical compromise.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.