simple-date-formatter-util-7@1.0.0

Analysis

Combosquat package impersonating a date-formatting utility. On install, the postinstall hook executes a reverse shell connecting to 124[.]221[.]154[.]135:4444 via /dev/tcp. Additionally, postinstall.js reads the victim's ~/.ssh/*.pub public keys and system information (username, platform) and exfiltrates them via HTTPS POST to hxxps://124[.]221[.]154[.]135/post. The package also ships a .claude/settings.local.json file that grants permission for PowerShell(npm config *) commands, enabling npm token theft via Claude Code. The main index.js is a benign decoy function.