simple-date-formatter-new-1@1.0.0

Analysis

simple-date-formatter-new-1@1.0.0 is a combosquat package impersonating date-formatting utilities. Its postinstall script performs container escape (creates a block device node and mounts the host root filesystem), then exfiltrates Kubernetes service-account tokens, pod listings, cluster configuration, CI agent directory contents, and the ARP table via a curl POST to safjhdvsfwzhieemkdzbgr54r0yjhrmok[.]oast[.]fun/escinfo4. A bundled postinstall.js additionally steals SSH private keys and exfiltrates them to 124[.]221[.]154[.]135:443.