simple-date-formatter-new-13@1.0.0

Analysis

The package runs a malicious postinstall hook on install. It downloads a remote file to /tmp/bsrc.txt and POSTs its contents to the callback host pdxkwzizhzzdpzpgcieqk6d1v7ynqsgfo[.]oast[.]fun/bsrc. A bundled postinstall.js script enumerates the user's ~/.ssh directory for public-key filenames, collects the OS username and platform, and exfiltrates this data as JSON to hxxps://124[.]221[.]154[.]135:443/post. The package is a combosquat on the "simple-date-formatter" name.