The npm package date-format-utils-xz versions 1.0.3 and 1.0.4 contains malicious code that executes automatically upon installation. The postinstall.js script performs host reconnaissance commands and collects environment variables, including potential CI/build secrets. It also queries cloud instance metadata endpoints for AWS, Aliyun, and Tencent Cloud to harvest temporary IAM/role credentials. The collected data is sent unencrypted to a hardcoded external IP address. The package is disguised as a legitimate date-formatting utility but is confirmed malicious by internal comments.