The npm package 'date-fns-lite' versions 1.0.0 through 1.0.12 is a malicious package that masquerades as a lightweight date-formatting utility. It contains a postinstall script that executes automatically upon installation, harvesting sensitive credentials and configuration files from the host, including AWS, GCP, and Azure credentials, SSH keys, kubeconfig, /etc/shadow, and shell history. It also performs reconnaissance by querying cloud metadata services, enumerating Docker containers, and scanning the internal network. The collected data is sent to a hardcoded external IP address over unencrypted HTTP. This package poses a significant risk especially when installed in CI environments or containers with host filesystem mounts.