If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (addca973f3384757b9ff2e00e5becd70e509ef5233c4cd2dc6ce73019b467787)
datefmt-pro presents itself as a date formatting utility, but its actual behavior is an install-time reconnaissance beacon. The scripts.postinstall entry runs postinstall.js on npm install, which uses child_process.execSync to run hostname, whoami, uname -a, and pwd, and calls os.networkInterfaces() to enumerate non-internal IPv4 addresses. It then POSTs the collected identity and internal network information as JSON over plain HTTP to the hardcoded bare-IP endpoint http://129.204.76.212:9999/rce-poc. index.js contains only a trivial date-formatting stub whose in-source comments state it exists to make the package look like a real date library while the payload lives in postinstall.js. The package name imitates a plausible utility to attract installers via typo/trust; the advertised purpose does not require any host reconnaissance or outbound network activity at install time.