If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (2f5ed3c402677fcfaeac396b55b9db5280445e9b0130133cc311a83f96f2a0de)
Package advertises itself as a date-formatting utility but its actual behavior on install is credential theft and internal-network reconnaissance. The `postinstall` script in package.json runs a shell one-liner that probes internal Kubernetes API endpoints, dumps `/etc/resolv.conf` and `ip route`, TCP-scans internal hosts, reads the pod's Kubernetes service-account token from `/var/run/secrets/kubernetes.io/serviceaccount/token`, and POSTs the aggregated output via curl to a hardcoded OAST (interact.sh) collector at http://safjhdvsfwzhieemkdzbgr54r0yjhrmok.oast.fun/escinfo8. A bundled `postinstall.js` additionally enumerates `~/.ssh` (listing public keys), collects the local username and platform, and POSTs the JSON to a hardcoded IP 124.221.154.135 over HTTPS; in-file comments describe it as an SSH-key theft C2 demo. The library payload (`index.js`) is a three-line wrapper around `toLocaleDateString`, functioning solely as cover for the install-time attack.