Malicious npm package published as a date-formatting utility (@daylightqc/date-fmt-lite). Its postinstall hook and an import-time execSync call harvest /etc/passwd, /etc/shadow, SSH private keys, process environment variables, .npmrc auth tokens and Kubernetes service-account tokens, and probe the AWS, Alibaba, Tencent and GCP cloud-metadata endpoints, then exfiltrate the collected data to a hardcoded command-and-control server at 129.204.76.212:9999. The package has no legitimate functionality. Confirmed malicious: credential harvesting and data exfiltration via install-time remote code execution.