@adominadmininstr/date-util-helper@1.0.0

Analysis

The package @adominadmininstr/date-util-helper@1.0.0 runs a postinstall script (postinstall.js) on installation. The script collects system information (hostname, username, working directory, OS details, process list, IP addresses, DNS configuration), probes cloud metadata endpoints at hxxp://metadata[.]tencentyun[.]com/latest/meta-data/ and hxxp://169[.]254[.]169[.]254/latest/meta-data/, and harvests all environment variables including CI/CD tokens and cloud credentials. The collected data is base64-encoded and exfiltrated via an HTTP GET request to pzs5w7ntzhsnepwk564lyfdci3oucl0a[.]oastify[.]com/z?d=<base64-data>. The exfiltrated environment variables include NPM_TOKEN, GITHUB_TOKEN, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and other CI/CD platform secrets.