{
  "schema_version": "1.6.0",
  "id": "CLR-2026-2991",
  "modified": "2026-07-01T12:59:00Z",
  "published": "2026-07-01T12:59:00Z",
  "summary": "A date-utility dropper — and the campaign it belongs to",
  "details": "The npm package fmt-date-lite@1.0.0 advertised itself as a \"Lightweight date formatting utility with locale support.\" Its actual behaviour is a supply-chain dropper: a postinstall hook downloads and executes a remote payload from a hardcoded IP on npm install. It is a near-identical twin of datefmt-helper (CLR-2026-2990) and part of a coordinated campaign of date-utility droppers — surfaced by codelake's dropper-hunting pipeline before any public advisory for this package existed.",
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "fmt-date-lite"
      },
      "versions": [
        "1.0.0"
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://research.codelake.dev/advisories/clr-2026-2991-fmt-date-lite"
    }
  ],
  "credits": [
    {
      "name": "Sascha Klein, codelake Research",
      "type": "FINDER",
      "contact": [
        "https://research.codelake.dev"
      ]
    }
  ],
  "database_specific": {
    "caseId": "CLR-2026-2991",
    "kind": "malware",
    "severity": "Critical",
    "status": "Confirmed malicious",
    "iocs": {
      "ips": [
        "155.190.124.243",
        "115.190.124.243"
      ],
      "hashes": [
        "sha256:987872707c668af0739f7d0193c1db906eb87e0749a5801a8a166a0aa2735136"
      ],
      "indicators": [
        "155.190.124.243:6788 (hardcoded remote endpoint — validated routable; payload fetch target)",
        "postinstall → node postinstall.js (network fetch + child_process / execSync execution)",
        "fmt-date-lite@1.0.0 (npm) — impersonates a \"Lightweight date formatting utility\"; 6 files, no repository, no deps",
        "987872707c668af0739f7d0193c1db906eb87e0749a5801a8a166a0aa2735136 · fmt-date-lite-1.0.0.tgz",
        "115.190.124.243 (sibling C2 — datefmt-helper / CLR-2026-2990 and date-fns-lite / OSV MAL-2026-6722)"
      ]
    }
  }
}