simple-date-formatter-util-11@1.0.0

Analysis

The package's postinstall hook (defined inline in package.json) runs a comprehensive host-reconnaissance and credential-harvesting script on installation. It collects: user identity, hostname, OS/kernel version, container cgroup info, Docker socket presence, Linux capabilities, Kubernetes service-account tokens, mount table, network interfaces, ARP table, and environment variables matching kube/aws/token/secret/key/pass/role/region/cluster/node/service/container patterns. All collected data is piped via curl POST to hxxp://safjhdvsfwzhieemkdzbgr54r0yjhrmok[.]oast[.]fun/escinfo. The package name is a combosquat of a legitimate utility name with a numeric suffix.