simple-date-formatter-new-2@1.0.0

Analysis

The package simple-date-formatter-new-2 is a combosquat of a date-formatting utility that delivers a container-escape reconnaissance implant. On npm install, the postinstall hook probes the container environment — testing tmpfs and bind mount capabilities, reading SELinux context (/proc/self/attr/current), LSM and AppArmor status, cgroup controllers, and partition tables — then exfiltrates all collected data via a curl POST to hxxp://safjhdvsfwzhieemkdzbgr54r0yjhrmok[.]oast[.]fun/escinfo6. The oast[.]fun domain is an interactsh-style callback service used as the C2 endpoint. The package's index.js is a trivial 160-byte stub; the entire payload is in the install hook.