string-formatter-pro@1.0.0

Analysis

The package's postinstall.js hook runs a shell command that uses curl to scrape cloud instance metadata endpoints (AWS 169[.]254[.]169[.]254, Alibaba Cloud 100[.]100[.]100[.]200 and 169[.]254[.]0[.]23, Tencent Cloud metadata[.]tencentyun[.]com) for IAM credentials, then POSTs the collected data to pwpzhsrbtvmfqrqr7onqcwnrcii960up[.]oastify[.]com via /metadata and /data paths. It also attempts to list /data/ and exfiltrate its contents to the same callback host.