simple-date-formatter-new-14@1.0.0

Summary

The package presents itself as a date-formatting utility (index.js is a 160-byte formatDate stub) but the published tarball contains an SSH-key exfiltration payload and an install-time DNS beacon. package.json declares a postinstall lifecycle script that runs 'nslookup 9e954818.log.dnslogs.dpdns.org', causing every installer to beacon a per-package token to attacker-controlled DNS logging infrastructure at install time, leaking installer presence and resolver IP. A sibling postinstall.js reads ~/.ssh (enumerating.pub files and related host/user identifiers) and POSTs the collected data over HTTPS to a hardcoded bare IP endpoint at https://124.221.154.135/post; comments in the file describe SSH key theft and C2 exfiltration. The name-collision between the declared postinstall hook and the stealer filename, combined with the empty author field and typosquat-style package name, is consistent with a disposable supply-chain payload.

Source: amazon-inspector (cbe2adf4e9d3b54b33c0e80285a5b0eb4d81dfde75c7a5b7a202ac43793268cd)