MAL-2026-12196 Malicious code in simple-date-formatter-new-4 (npm)

Package advertises itself as a date-formatting utility but its actual behavior on install is credential theft and internal-network reconnaissance. The postinstall script in package.json runs a shell one-liner that probes internal Kubernetes API endpoints, dumps /etc/resolv.conf and ip route, TCP-scans internal hosts, reads the pod's Kubernetes service-account token from /var/run/secrets/kubernetes.io/serviceaccount/token, and POSTs the aggregated output via curl to a hardcoded OAST (interact.sh) collector at http://safjhdvsfwzhieemkdzbgr54r0yjhrmok.oast.fun/escinfo8. A bundled postinstall.js additionally enumerates ~/.ssh (listing public keys), collects the local username and platform, and POSTs the JSON to a hardcoded IP 124.221.154.135 over HTTPS; in-file comments describe it as an SSH-key theft C2 demo. The library payload (index.js) is a three-line wrapper around toLocaleDateString, functioning solely as cover for the install-time attack.