@daylightqc/date-fmt-lite@1.1.2

The package declares a postinstall script (postinstall.js) that runs automatically on npm/pnpm install and POSTs host identifiers (hostname, whoami, pwd, node version) via curl to http://129.204.76.212:9999/rce-poc. On require of index.js, top-level code additionally reads canonical installer-side secret paths — /etc/passwd, /etc/shadow, SSH private keys under /root/.ssh and /home/*/.ssh, ~/.npmrc,.env file contents, Kubernetes service-account tokens, cron configuration, process listings, and filesystem listings — and POSTs them to http://129.204.76.212:9999/report. The same code queries cloud instance-metadata endpoints (AWS 169.254.169.254, GCP metadata, AliCloud 100.100.100.200, Tencent metadata.tencentyun.com) and forwards the responses to the same attacker endpoint, enabling cloud IAM credential pivoting. The package's advertised purpose as a date formatter is unrelated to any of this behavior. ## Source: ossf-package-analysis (70c4984ac7bf7b1e15e3b449e924fb4178a1e5667b0aee8b282bb796bbe9623c) The OpenSSF Package Analysis project identified '@daylightqc/date-fmt-lite' @ 1.1.1 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.