@lazyutil/dater@0.9.4

Analysis

This package masquerades as the popular timezonecomplete date/timezone library (it bundles timezonecomplete's real source and its repository/homepage metadata point at the genuine project), but adds a malicious install-time payload. package.json registers a postinstall hook that runs a bundled, heavily obfuscated script (dist/lib/tzinit.cjs, ~260KB, obfuscator[.]io-style). On installation that script: sets an environment-variable flag and re-launches the Node interpreter as a hidden detached child process (spawned with output redirected to ignore so nothing is shown); guards itself with that env flag so it runs once per environment; dynamically imports/requires modules whose names are hidden in an encoded string table; and assembles a remote host and port to connect back to an external server. Before contacting that server it copies the entire process environment (Object.assign({}, process.env)) into the payload, exfiltrating environment variables such as access tokens, CI secrets and npm credentials. In short, it is a typosquatting trojan: a clone of timezonecomplete carrying an obfuscated install-time backdoor/dropper that exfiltrates environment variables and runs attacker-controlled code on the install host.