32 matches found
Malicious code in simple-date-formatter-new-16 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e57e9eff2fae987a2a23e3107d64c818e020b03380e31d6a3ae9cf8d4eb14ec package.json declares a postinstall lifecycle script that pipes a string-reversed shell one-liner through rev | bash, decoding to a bash reverse shel...
Malicious code in simple-date-formatter-new-14 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbe2adf4e9d3b54b33c0e80285a5b0eb4d81dfde75c7a5b7a202ac43793268cd The package presents itself as a date-formatting utility index.js is a 160-byte formatDate stub but the published tarball contains an SSH-key...
Malicious code in simple-date-formatter-new-13 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f295d4208d67cbb14c8804b287109ad5ed7946e39f0256e601f846e485c6c54 [email protected] presents itself as a date-formatting utility but ships a trivial three-line stub while its package.json postinstal...
Malicious code in simple-date-formatter-new-15 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 005b96d3c3d5f1a071c40a8b72ea22b5e0221db32cfffacfc8f2343f0ee97eb0 The package's package.json postinstall script curls cloud instance-metadata endpoints AWS IMDS at 169.254.169.254/latest/meta-data/sts-credential,...
Malicious code in simple-date-formatter-new-11 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10e00618100992f74fd0b4c908be0db1c3e13de1b37ae9dc5952b7836f564042 Package presents itself as a date-formatting utility but performs credential theft against the installer through two channels. The postinstall script...
MAL-2026-11502 Malicious code in simple-date-formatter-new-1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 628527c388185356d23a8905edf240a32c062afb06c00a58c0101ffd4bcc5182 On npm install, the package.json postinstall hook executes a shell one-liner that attempts to mount the host block device via mknod, enumerates...
Malicious code in simple-date-formatter-util-5 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb6c0d10eabca0cef05a136e2ffd68781a965747ad1e75bf9fd9528292bbe429 The package is advertised as a date-formatting utility but its package.json postinstall script curls cloud-provider instance metadata endpoints AWS...
MAL-2026-11501 Malicious code in simple-date-formatter-util-5 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb6c0d10eabca0cef05a136e2ffd68781a965747ad1e75bf9fd9528292bbe429 The package is advertised as a date-formatting utility but its package.json postinstall script curls cloud-provider instance metadata endpoints AWS...
Malicious code in simple-date-formatter-util-2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2102f256bd17b2a80b2157371bee5a3cc1d9c49484aaef694a094218c2a7bac The package.json postinstall script runs on every npm install and uses curl to probe cloud instance-metadata services AWS 169.254.169.254, Alibaba...
Malicious code in simple-date-formatter-util (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e828348e997bf53071c8bc1d24adc305be689a64a56f2ababda6ef9370948d3 The package appears to be a small date-formatting utility. No credential access, no install-time or import-time network activity, no lifecycle script...
MAL-2026-11485 Malicious code in simple-date-formatter-util-2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2102f256bd17b2a80b2157371bee5a3cc1d9c49484aaef694a094218c2a7bac The package.json postinstall script runs on every npm install and uses curl to probe cloud instance-metadata services AWS 169.254.169.254, Alibaba...
MAL-2026-11483 Malicious code in simple-date-formatter-util (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e828348e997bf53071c8bc1d24adc305be689a64a56f2ababda6ef9370948d3 The package appears to be a small date-formatting utility. No credential access, no install-time or import-time network activity, no lifecycle script...
Malicious code in simple-date-formatter-util-1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f633eec2e322fce0493ff996493eebe8036c628be4ab0caf4844928d6ccdf10f Package advertises itself as a date formatting utility but ships an active install-time exfiltration payload. package.json declares a postinstall hoo...
MAL-2026-11484 Malicious code in simple-date-formatter-util-1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f633eec2e322fce0493ff996493eebe8036c628be4ab0caf4844928d6ccdf10f Package advertises itself as a date formatting utility but ships an active install-time exfiltration payload. package.json declares a postinstall hoo...
EUVD-2026-44568
Twig is a template language for PHP. Prior to 3.26.0, twig/intl-extra memoises IntlDateFormatter and NumberFormatter instances in arrays keyed by template-controlled filter arguments such as locale, pattern, and attrs, allowing a template to allocate many ICU formatter objects that remain pinned...
twig/intl-extra: Unbounded formatter memoisation in keyed on template-controlled arguments
Description IntlExtension memoises every \IntlDateFormatter and \NumberFormatter it creates in instance-level arrays keyed on a hash that includes locale, pattern, attrs and other values that are ordinary named arguments of the formatdatetime / formatdate / formattime / formatnumber /...
PT-2026-42588
Description IntlExtension memoises every IntlDateFormatter and NumberFormatter it creates in instance-level arrays keyed on a hash that includes locale, pattern, attrs and other values that are ordinary named arguments of the format datetime / format date / format time / format number / format...
[SECURITY] Fedora 43 Update: php-php81_bc-strftime-0.7.6-1.fc43
The strftime function has been marked as deprecated in PHP 8.1. This package provides a locale-formatted strftime implementation using IntlDateFormatter, for projects seeking an easy, backwards-compatible solution...
