date-sanitize-helper@1.0.0

Analysis

The package's postinstall.js hook collects extensive system and environment information and exfiltrates it to an attacker-controlled OAST callback host. On install, it gathers: hostname, username, user ID, sudo privileges, OS version, working directory, cgroup info, Docker environment detection, GitHub CI variables (GITHUB_REPOSITORY, GITHUB_ACTOR, GITHUB_REF, GITHUB_JOB, GITHUB_RUN_ID, GITHUB_WORKFLOW, GITHUB_EVENT_NAME), and all environment variables matching KEY/TOKEN/SECRET/CREDENTIAL patterns. It probes cloud metadata endpoints across three providers: Tencent Cloud (metadata[.]tencentyun[.]com/latest/meta-data/ and /instance-id), AWS (169[.]254[.]169[.]254/latest/meta-data/), and Alibaba Cloud (100[.]100[.]100[.]200/latest/meta-data/). It also probes tst[.]woa[.]com/ and tst[.]woa[.]com/flag.html. All collected data is base64-encoded and sent via HTTP GET to pzs5w7ntzhsnepwk564lyfdci3oucl0a[.]oastify[.]com/x?d=<base64>. The package has no repository, no legitimate functionality beyond the malicious postinstall hook.