sheratan_haha@1.0.0

Analysis

Malicious package published by a known bad actor (same email who published the confirmed-malicious sheratan_test_p). The postinstall hook runs exec('whoami') and exfiltrates the output via HTTPS POST to webhook[.]site/0ea9eb45-3ede-4cf0-9ea9-2b8d700272e7 — a classic beacon/exfiltration pattern. The package misrepresents itself as "A simple date formatting utility" but ships no functional code (main.js is 0 bytes). It also depends on the publisher's own known-malware package sheratan_test_p, compounding the supply-chain risk.