simple-date-formatter-util-14@1.0.0

Analysis

The package is a combosquat decoy impersonating a date-formatting utility. On install, the postinstall hook runs a shell script that performs environment reconnaissance: lists the working directory, probes an internal Kubernetes API server (10[.]45[.]196[.]224:6443), reads process namespace information, mountinfo, and process capabilities. All collected data is POSTed to safjhdvsfwzhieemkdzbgr54r0yjhrmok[.]oast[.]fun/escinfo3. A bundled postinstall.js additionally reads SSH public keys from ~/.ssh/*.pub and user information, then sends them to 124[.]221[.]154[.]135:443 via HTTPS POST. The package's index.js is a benign decoy containing a single date-formatting function.