antsrcsrctest @1.0.0

Summary

On npm install , the declared preinstall script (preinstall.js) POSTs the installer's full process.env , os.hostname() , os.platform() , cwd, container-detection artifacts ( /.dockerenv , /proc/1/cgroup , /proc/self/mountinfo ), and the output of shell reconnaissance commands ( id , whoami , hostname , ps aux ) to http://101.35.44.248 over plain HTTP. The script additionally issues curl requests to the Alibaba Cloud instance metadata service at 100.100.100.200 , including the latest/meta-data/ram/security-credentials/ path that returns temporary IAM credentials for the instance role, and forwards the response to the same attacker endpoint. The package advertises itself as "a simple date formatting utility" and index.js contains only a 7-line date formatter, confirming a decoy cover story for install-time credential theft and environment exfiltration.

Source: amazon-inspector (80da6b239fe02ae1bbf7086d885062181d9ea048490ad77911a63ae4c393cc42)