simple-date-formatter-util-4@1.0.0

Analysis

The package is a trojanized date-formatting utility. On install, the postinstall hook scrapes cloud instance metadata from AWS (169[.]254[.]169[.]254), Alibaba Cloud (100[.]100[.]100[.]200), and Tencent Cloud (metadata[.]tencentyun[.]com, 169[.]254[.]0[.]23) endpoints, fetches IAM security credentials, and exfiltrates the collected data via HTTP POST to ycrqyyjhwepdmhjifyccxss1hrks8lcd2[.]oast[.]fun/metadata. It also lists the /data/ directory and exfiltrates that. A bundled postinstall.js file reads ~/.ssh/ public keys and sends them to 124[.]221[.]154[.]135:443. The package's index.js is a benign decoy function. A .claude/settings.local.json file attempts to bypass Claude Code's security sandbox by allowing PowerShell(npm config *) commands.