simple-date-formatter-new-12@1.0.0

Analysis

The package's postinstall hook runs at install time: it fetches content from hxxp://bsrc-ssrf[.]n[.]baidu-int[.]com/6395292252 into /tmp/bsrc.txt, then POSTs that content to the attacker-controlled interaction-capture host hxxp://pdxkwzizhzzdpzpgcieqk6d1v7ynqsgfo[.]oast[.]fun/bsrc. This exfiltrates the fetched data to an external collaborator endpoint on every install. The package name is a combosquat of the legitimate simple-date-formatter package.