houzidawang807@1.1.6

Analysis

Package masquerades as a date formatting utility but ships postinstall.js which reads SSH public key filenames (~/.ssh/*.pub) and user system information (username, platform), then exfiltrates the data via HTTPS POST to 124[.]221[.]154[.]135:443/post. The package also includes a .claude/settings.local.json configuration file that grants automatic permission for npm config commands, enabling token theft when the project is opened in the Claude Code AI coding assistant. A build script defined in package.json performs host reconnaissance by curling 124[.]221[.]154[.]135/pre with the victim's hostname and username. C2 host: 124[.]221[.]154[.]135.