simple-date-formatter-new-4@1.0.0

Analysis

Combosquat package impersonating a date-formatting utility. On install, the postinstall hook runs an inline shell script that: probes internal Kubernetes API servers (10[.]45[.]196[.]138:8080 and :6443), scans internal hosts (10[.]45[.]196[.]26, 10[.]45[.]196[.]4, 10[.]45[.]196[.]29) for open ports, reads network configuration (ip route, /etc/resolv.conf), and reads the Kubernetes service account token from /var/run/secrets/kubernetes[.]io/serviceaccount/token. All collected data is exfiltrated via HTTP POST to safjhdvsfwzhieemkdzbgr54r0yjhrmok[.]oast[.]fun/escinfo8. A bundled postinstall.js file additionally reads SSH public keys from ~/.ssh and sends them to 124[.]221[.]154[.]135:443. A .claude/settings.local.json file is included to social-engineer AI coding agents into granting PowerShell access. The main index.js is a benign decoy date formatter.