time-format-kit@1.0.2

Analysis

time-format-kit@1.0.2 is a combosquat package impersonating a dayjs ecosystem utility. Its postinstall.js hook decodes three base64-encoded shell commands and executes them via child_process.exec. The first command performs comprehensive system reconnaissance: collects hostname, username, user ID, sudo privileges, OS version, working directory, shell, Docker status, cgroup info, network configuration, process list, and the full environment variable block. It then reads and exfiltrates ~/.aws/credentials, ~/.ssh/id_rsa, ~/.ssh/authorized_keys, ~/.ssh/known_hosts, Docker process list, filesystem listing, and ~/.bash_history. All collected data is base64-encoded and sent via curl to pwpzhsrbtvmfqrqr7onqcwnrcii960up[.]oastify[.]com/ing?d=... (an interactsh callback server). The second command fetches hxxp://tst[.]woa[.]com/flag[.]html and forwards it to the same interactsh endpoint. The third command uses hxxp://tst[.]woa[.]com/ssrf_forward[.]php?host=pwpzhsrbtvmfqrqr7onqcwnrcii960up[.]oastify[.]com as an SSRF proxy. The exfiltrated environment includes GITHUB_TOKEN, NPM_TOKEN, OPENAI_API_KEY, ANTHROPIC_API_KEY, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, STRIPE_SECRET_KEY, SENDGRID_API_KEY, SLACK_TOKEN, TWILIO_AUTH_TOKEN, DIGITALOCEAN_TOKEN, NETLIFY_AUTH_TOKEN, VERCEL_TOKEN, CLOUDFLARE_API_TOKEN, PYPI_TOKEN, CARGO_REGISTRY_TOKEN, GITLAB_TOKEN, and HF_TOKEN. The package contains no actual date-formatting functionality — index.js is 67 bytes, while the malicious postinstall.js is 3868 bytes.