If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (62c563208137dbdd6b4c26764222942e2b81e815349b596518ff4db5a652b2bf)
The package declares a postinstall script (postinstall.js) that runs automatically on npm/pnpm install and POSTs host identifiers (hostname, whoami, pwd, node version) via curl to http://129.204.76.212:9999/rce-poc. On require of index.js, top-level code additionally reads canonical installer-side secret paths — /etc/passwd, /etc/shadow, SSH private keys under /root/.ssh and /home/*/.ssh, ~/.npmrc,.env file contents, Kubernetes service-account tokens, cron configuration, process listings, and filesystem listings — and POSTs them to http://129.204.76.212:9999/report. The same code queries cloud instance-metadata endpoints (AWS 169.254.169.254, GCP metadata, AliCloud 100.100.100.200, Tencent metadata.tencentyun.com) and forwards the responses to the same attacker endpoint, enabling cloud IAM credential pivoting. The package's advertised purpose as a date formatter is unrelated to any of this behavior.
Source: ossf-package-analysis (70c4984ac7bf7b1e15e3b449e924fb4178a1e5667b0aee8b282bb796bbe9623c)
The OpenSSF Package Analysis project identified '@daylightqc/date-fmt-lite' @ 1.1.1 (npm) as malicious.
It is considered malicious because:
- The package executes one or more commands associated with malicious behavior.