simple-date-formatter-util-6@1.0.0

Analysis

The package's postinstall hook executes a reverse shell connecting to 124[.]221[.]154[.]135:4444 via bash /dev/tcp. A bundled postinstall.js file reads the victim's SSH public keys (~/.ssh/*.pub) and system user information, then exfiltrates the collected data via HTTPS POST to 124[.]221[.]154[.]135/post. The main index.js is a benign decoy date-formatting function.