The 'date-kit-lite' npm package version 1.0.0 contains malicious code in its postinstall lifecycle script that executes the 'id' command to obtain the installer's user ID, group ID, and group memberships. It then sends this information to a hardcoded bare IP address (http://155.190.124.243:6788) using three redundant transport methods (node http.get, curl, wget) with error suppression to maximize successful data exfiltration. The beacon also transmits the installer's IP address, User-Agent, and host identity, enabling follow-on targeting. This behavior occurs automatically during 'npm install' and is unrelated to the package's declared purpose as a date utility. The package name and description mimic legitimate date helper libraries, and the author field is a placeholder, consistent with a disguised dropper targeting incidental installers.

Installation of this package results in unauthorized disclosure of system user and group information, as well as network and host identifiers, to a remote attacker-controlled server. This data leakage can facilitate further targeted attacks against the affected system or network. The malicious activity occurs silently during package installation without user consent or awareness.

No official patch or remediation is available for this package. The best mitigation is to avoid installing 'date-kit-lite' version 1.0.0 from untrusted sources. Users should verify package authenticity and prefer well-known, trusted date utility libraries. Since this is a malicious package, removal of the package and investigation for any follow-on compromise is recommended if it was installed.