simple-date-formatter-util-16@1.0.0

Analysis

Combosquat package impersonating a date-formatting utility. On npm install, the postinstall hook runs two payloads: (1) postinstall.js reads SSH public keys from ~/.ssh/ and user account metadata, then exfiltrates them via HTTPS POST to 124[.]221[.]154[.]135:443; (2) an inline shell script creates a block device node, mounts the host filesystem, enumerates Kubernetes configuration files and serviceaccount tokens, lists /var/lib/kubelet/pods/, and pipes all collected data via curl POST to safjhdvsfwzhieemkdzbgr54r0yjhrmok[.]oast[.]fun/escinfo4. The package's index.js is a benign decoy function.