simple-date-formatter-new-11@1.0.0

Analysis

The package's postinstall hook harvests cloud-provider instance metadata from the Aliyun (100[.]100[.]100[.]200), AWS (169[.]254[.]169[.]254), and Tencent (metadata[.]tencentyun[.]com, 169[.]254[.]0[.]23) metadata endpoints, then POSTs the collected metadata and the output of `ls -la /data/` to the attacker-controlled collaborator host pdxkwzizhzzdpzpgcieqk6d1v7ynqsgfo[.]oast[.]fun (paths /metadata and /data). The package otherwise contains only a trivial date-formatter stub; its real purpose is harvesting cloud credentials and environment data on install.