format-helper-lib@1.0.0

Analysis

The package is named and described as a benign date/number formatting helper, but its postinstall hook (install-cb.js) runs a container-escape reconnaissance probe. On install it fingerprints the host and container runtime (hostname, OS release, kernel cmdline, runc/containerd/cri-o/docker versions), enumerates security posture (seccomp, AppArmor, SELinux, process capabilities, UID/GID maps, namespace links, /dev), checks for container runtime sockets, tests NFS root-squash, and probes NFS server ports 111 and 2049 on 10[.]0[.]128[.]136. Collected results are written to NCODE_RUNTIME.txt and NCODE_POC_MARKER.txt in the install directory and its parents.