datefmt-helper@1.0.0

Analysis

On npm install, the postinstall hook (postinstall.js) downloads and executes a remote script from a hardcoded IP. On Linux/macOS it fetches hxxp://115[.]190[.]124[.]243:8761/slt and pipes it to sh; on Windows it downloads hxxp://115[.]190[.]124[.]243:8761/swt to C:\Users\Public\run.bat and runs it. The package's index.js is a benign date-formatting decoy; the malicious behaviour is in the lifecycle hook.