🛡️ MAL-2026-10731 — date-utils-light

Malicious code in date-utils-light (npm)

Source: amazon-inspector

Package presents itself as a trivial date-formatting utility (index.js exports a one-line ISO date helper) but ships a postinstall.js that runs automatically on npm install. The script shells out via child_process.exec to collect host reconnaissance — hostname, whoami, id, uname, pwd, /etc/os-release, HOME, SHELL, container indicators, /proc/1/cgroup, network interfaces, and running process list — base64-encodes the data, and sends it via HTTP GET to a hardcoded Burp Collaborator subdomain at pwpzhsrbtvmfqrqr7onqcwnrcii960up.oastify.com/ing?d=<base64>. The stated purpose of the package does not require any shell execution or network activity; the install-time reconnaissance beacon is unrelated to the advertised functionality.