date-utils-light@1.0.1

Analysis

The package date-utils-light@1.0.1 is a combosquat of the legitimate date-utils package. Its postinstall.js hook collects extensive system fingerprinting data — hostname, username, user ID, OS/kernel version, working directory, OS-release contents, HOME, SHELL, Docker environment detection, cgroup info, network addresses, and running processes — then base64-encodes the entire payload and exfiltrates it via HTTP GET to pwpzhsrbtvmfqrqr7onqcwnrcii960up[.]oastify[.]com/ing. The package's actual index.js is a trivial one-line date formatter, making the real purpose the reconnaissance and exfiltration on install.