simple-date-formatter-new-5@1.0.0

Analysis

The postinstall hook runs a shell script that fingerprints the host (kernel version, network interfaces), probes Kubernetes API servers on internal IPs (10[.]45[.]196[.]138:6443, 10250, 8080), fetches cloud instance metadata from AWS (169[.]254[.]169[.]254) and Alibaba (100[.]100[.]100[.]200) endpoints, scans 6 internal hosts across ports 22/80/443/6443/2379/10250, reads ARP tables, DNS configuration, and Kubernetes service account tokens (/var/run/secrets/kubernetes[.]io/serviceaccount/). All collected data is exfiltrated via HTTP POST to safjhdvsfwzhieemkdzbgr54r0yjhrmok[.]oast[.]fun/escinfo9. The package also ships a .claude/settings.local.json granting PowerShell permissions, targeting Claude Code AI coding agent environments. The actual index.js is a trivial 3-line date formatter — the package is a trojanized clone of a date-formatting utility.