simple-date-formatter-new-3@1.0.0

Analysis

simple-date-formatter-new-3 is a combosquat of a date-formatting utility. On install, the postinstall hook runs a shell script that performs container-escape reconnaissance (enumerating kernel version, cgroups, process namespaces, block devices, and attempting cgroup escape via mknod+mount) and pipes the results to safjhdvsfwzhieemkdzbgr54r0yjhrmok[.]oast[.]fun/escinfo7. A bundled postinstall.js reads SSH public keys from ~/.ssh/ and exfiltrates them via HTTPS POST to 124[.]221[.]154[.]135. The package also ships a .claude/settings.local.json that grants PowerShell(npm config *) permissions, suggesting npm token theft as a secondary objective.