MAL-2026-11545 Malicious code in simple-date-formatter-util-15 (npm)

package.json declares a postinstall shell pipeline that attempts to mknod and mount the host block device at /tmp/hostroot, enumerates /etc/kubernetes and kubelet pods, reads the Kubernetes service-account token at /var/run/secrets/kubernetes.io/serviceaccount/token, lists /home/work/skills/canvas-agent/, dumps /proc/net/arp, and POSTs the collected output via curl to http://safjhdvsfwzhieemkdzbgr54r0yjhrmok.oast.fun/escinfo4 (an interactsh OAST subdomain). A companion postinstall.js in the tarball enumerates the installer's ~/.ssh directory, collects filenames alongside os.userInfo(), and POSTs the result over HTTPS to the hardcoded IP 124.221.154.135:443/post. The package's declared purpose ("simple date formatter") has no relationship to reading Kubernetes secrets, host block devices, or SSH keys. Install-time execution of this script harvests container-escape and credential material and ships it to attacker-controlled destinations.