simple-date-formatter-util-9@1.0.0

Analysis

simple-date-formatter-util-9@1.0.0 is a combosquat package impersonating a date-formatting utility. On install, the postinstall hook executes a bash reverse shell connecting to 124[.]221[.]154[.]135:4444. A bundled postinstall.js script reads SSH public keys from ~/.ssh/ and exfiltrates them along with system user info via HTTPS POST to 124[.]221[.]154[.]135/post. The package also ships a .claude/settings.local.json file that grants permission for PowerShell-based npm config access, enabling npm token theft via Claude Code. The main index.js is a benign decoy date formatter.