If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (204253c08cc90b592f9c086ada633879141aee2bdf27e7286007c709f3b866ab)
Package advertised as a date-formatting utility performs supply-chain attack behavior. package.json declares a postinstall shell one-liner that, on npm install, collects kernel version, IP addresses, Kubernetes API probes, cloud instance metadata (AWS 169.254.169.254 and Alibaba 100.100.100.200), an internal /24 TCP scan, ARP/DNS data, and a listing of /var/run/secrets/kubernetes.io/serviceaccount/, then POSTs the aggregated output via curl to http://safjhdvsfwzhieemkdzbgr54r0yjhrmok.oast.fun/escinfo9. The main module (index.js) additionally enumerates ~/.ssh for key files on require() and issues an HTTPS POST containing the directory listing plus username and platform to hardcoded IP 124.221.154.135:443/post. The advertised formatDate export is a trivial cover for the exfiltration code paths.