Supply chain · npm · High

Malicious npm package 'simple-date-formatter-new-12' conducts SSRF and data exfiltration

Threat Engine Auto-Feed · data current as of 2026-09-28

The npm package 'simple-date-formatter-new-12' version 1.0.0 contains malicious code that executes during installation. It performs Server-Side Request Forgery (SSRF) to an internal Baidu host and exfiltrates the response to an external collector, indicating a potential dependency confusion or typosquatting attack.

  • Package: npm / simple-date-formatter-new-12
  • Affected versions: = 1.0.0
  • Severity: critical
  • Reach: ~193/wk
  • Exposure: 70/100 (High)

What happened — Typosquatting

The npm package 'simple-date-formatter-new-12' version 1.0.0 includes a 'postinstall' script that automatically runs upon installation. This script uses 'curl' to access an internal Baidu host, saves the response to a temporary file, and then transmits the file's contents to an attacker-controlled external service. This activity is unrelated to the package's advertised function as a date formatter.

How the attack works

This is a supply-chain attack leveraging typosquatting. Malicious code embedded in a package's installation script executes automatically when the package is installed. This allows an attacker to perform actions like network reconnaissance (SSRF) and data exfiltration from the environment where the package is installed, without requiring the package's advertised functionality to be explicitly called.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that automatically pull package dependencies
  • Developers or systems that might inadvertently install typosquatted package names

Conditions that increase exposure

  • Unpinned dependency versions that could resolve to the malicious package
  • Lack of package lockfiles (e.g., package-lock.json) in projects
  • Use of internal package mirrors that might not filter malicious packages
  • Automated build systems that install dependencies without manual review

Blast-radius scenarios

  • An attacker could gain insight into internal network configurations and services via SSRF.
  • Sensitive internal network responses could be exfiltrated to an attacker-controlled server.
  • The installation environment's network position could be mapped by the attacker.

What to do (defensive)

Detect

  • Scan package dependencies for 'simple-date-formatter-new-12' version 1.0.0.
  • Monitor network traffic for outbound connections to 'pdxkwzizhzzdpzpgcieqk6d1v7ynqsgfo.oast.fun' or similar suspicious domains during package installation.
  • Review 'postinstall' scripts for newly added or suspicious npm packages.
  • Implement software composition analysis (SCA) tools to identify known malicious packages.

Contain

  • Immediately quarantine any systems or build environments found to have installed 'simple-date-formatter-new-12@1.0.0'.
  • Block network access to 'pdxkwzizhzzdpzpgcieqk6d1v7ynqsgfo.oast.fun' at the perimeter.
  • Remove 'simple-date-formatter-new-12' from all project dependencies and package registries.
  • Isolate affected development or build environments.

Remediate

  • Replace 'simple-date-formatter-new-12' with a legitimate, verified package if date formatting functionality is needed.
  • Force all projects to use package lockfiles (e.g., package-lock.json) and commit them to version control.
  • Implement strict dependency pinning to prevent automatic updates to potentially malicious versions.
  • Conduct a thorough audit of internal network logs for any signs of SSRF or exfiltrated data originating from affected systems.

Frontier verdict — High

Prioritize immediate detection and removal of 'simple-date-formatter-new-12' due to critical severity, SSRF, and data exfiltration capabilities.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.