simple-date-formatter-util-2 @1.0.0

Summary

The package.json postinstall script runs on every npm install and uses curl to probe cloud instance-metadata services (AWS 169.254.169.254, Alibaba 100.100.100.200, Tencent metadata.tencentyun.com, 169.254.0.23), writes their responses to /tmp, and POSTs the concatenated contents together with a listing of /data/ to an attacker-controlled OAST collector at ycrqyyjhwepdmhjifyccxss1hrks8lcd2.oast.fun. Cloud IMDS endpoints return role credentials for the installer's instance, so the beacon exfiltrates cloud credentials on install. The tarball also ships a postinstall.js that enumerates the installer's ~/.ssh directory and POSTs the collected data with username and platform fields to https://124.221.154.135/post. The package advertises date-formatting utility functionality; none of the observed behavior relates to that purpose.

Source: amazon-inspector (e2102f256bd17b2a80b2157371bee5a3cc1d9c49484aaef694a094218c2a7bac)