{
  "schema_version": "1.6.0",
  "id": "MAL-2026-6788",
  "modified": "2026-07-02T10:03:00Z",
  "published": "2026-07-02T10:03:00Z",
  "summary": "A download-and-execute dropper disguised as a date-formatting utility",
  "details": "The npm package datefmt-helper@1.0.0 advertised itself as a \"dates formatting utility with locale support.\" Its actual behaviour is a supply-chain dropper: a postinstall hook downloads and executes a remote payload from a hardcoded IP on npm install. codelake detected and classified it independently from the live npm feed — before any public advisory existed.",
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "datefmt-helper"
      },
      "versions": [
        "1.0.0"
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://research.codelake.dev/advisories/clr-2026-2990-datefmt-helper"
    },
    {
      "type": "ADVISORY",
      "url": "https://osv.dev/vulnerability/MAL-2026-6788"
    }
  ],
  "credits": [
    {
      "name": "Sascha Klein, codelake Research",
      "type": "FINDER",
      "contact": [
        "https://research.codelake.dev"
      ]
    }
  ],
  "database_specific": {
    "caseId": "CLR-2026-2990",
    "kind": "malware",
    "severity": "Critical",
    "status": "Confirmed malicious",
    "iocs": {
      "ips": [
        "115.190.124.243"
      ],
      "hashes": [
        "sha256:f2f58e73becce20f28c6f18700731f48c067826defe8279da2e24e4f69c25c72"
      ],
      "indicators": [
        "115.190.124.243 (hardcoded remote endpoint — validated routable; payload fetch target)",
        "postinstall → node postinstall.js (network download + child-process execution)",
        "datefmt-helper@1.0.0 (npm) — impersonates a \"dates formatting utility\"; no source repository",
        "f2f58e73becce20f28c6f18700731f48c067826defe8279da2e24e4f69c25c72 · datefmt-helper-1.0.0.tgz"
      ]
    }
  }
}