Source: amazon-inspector (7edc0c1f9cc25265504ab10c2634c3ea17e4028ff8412d4d7f4b22c41c33c3c9)

datefmt-simple-utils presents itself as a date-formatting utility, but its package.json declares scripts.postinstall="node postinstall.js", which fires automatically on npm install. postinstall.js connects a TCP socket to the hardcoded remote host 8.135.48.40 on port 4444 and attaches an interactive /bin/bash to that socket, giving the remote endpoint full command execution on the installer's machine. Three fallback techniques target the same host: a python3 pty.spawn reverse shell, a python3 subprocess-based variant, and a Node net.connect + spawn('/bin/bash', ['-i']) variant. The advertised date-formatting purpose is a cover story; no such functionality is wired into the install-time code path.

Credit: OpenSSF (source)

References

• https://github.com/ossf/malicious-packages/blob/b23255894dbc1a8e0336c0c8ea2fc5f9be4651a6/osv/malicious/npm/datefmt-simple-utils/MAL-2026-14032.json
• https://www.npmjs.com/package/datefmt-simple-utils/v/1.0.0