simple-date-formatter-new-7@1.0.0

Analysis

The package simple-date-formatter-new-7@1.0.0 is a combosquat of a date formatting utility that contains multi-stage malware. On install, the postinstall hook probes internal Kubernetes API endpoints (10[.]45[.]196[.]138:8080, 10[.]45[.]196[.]29:8080, 10[.]45[.]196[.]4:8080, 10[.]45[.]196[.]26:8080) to enumerate namespaces, pods, secrets, and nodes, then exfiltrates the results via HTTP POST to safjhdvsfwzhieemkdzbgr54r0yjhrmok[.]oast[.]fun/escinfo11. A bundled postinstall.js file reads SSH public keys from ~/.ssh and sends them to 124[.]221[.]154[.]135. A .claude/settings.local.json file grants PowerShell permissions for npm config manipulation, enabling token theft. The index.js exports a benign date formatting function as camouflage.