simple-date-formatter-new-4 @1.0.0

Summary

Package advertises itself as a date-formatting utility but its actual behavior on install is credential theft and internal-network reconnaissance. The postinstall script in package.json runs a shell one-liner that probes internal Kubernetes API endpoints, dumps /etc/resolv.conf and ip route , TCP-scans internal hosts, reads the pod's Kubernetes service-account token from /var/run/secrets/kubernetes.io/serviceaccount/token , and POSTs the aggregated output via curl to a hardcoded OAST (interact.sh) collector at http://safjhdvsfwzhieemkdzbgr54r0yjhrmok.oast.fun/escinfo8. A bundled postinstall.js additionally enumerates ~/.ssh (listing public keys), collects the local username and platform, and POSTs the JSON to a hardcoded IP 124.221.154.135 over HTTPS; in-file comments describe it as an SSH-key theft C2 demo. The library payload ( index.js ) is a three-line wrapper around toLocaleDateString , functioning solely as cover for the install-time attack.

Source: amazon-inspector (2f5ed3c402677fcfaeac396b55b9db5280445e9b0130133cc311a83f96f2a0de)