date-format-utils-xz @1.0.4

Summary

The package advertises itself as a date-formatting utility but ships a postinstall.js that runs automatically on npm install and performs unrelated host reconnaissance and credential harvesting. postinstall.js executes recon commands (hostname, whoami, id, env, ifconfig, ls /, /proc/1/cgroup) via execSync, then curls cloud instance-metadata endpoints at 169.254.169.254 for AWS, Aliyun, and Tencent Cloud — which on cloud VMs return temporary IAM/role credentials — and POSTs the aggregated JSON over plain HTTP to the hardcoded IP 8.135.48.40 at path /meta/all. A comment in index.js explicitly labels the package as disguised as a normal date-formatting tool, confirming the cover-story shape. The env dump additionally exposes CI/build secrets typically held in environment variables.

Source: amazon-inspector (4ed3237e0e3098910008ffa97c61cc346cdf252defb1f1ce8731316e4c394309)