sftc-advance-components@0.9.9

Analysis

A terminal snake game that exfiltrates system information during npm install and at runtime. The preinstall script (check-environment.js) and the game constructor both call a hex-obfuscated function (initSystem in utils.js) that collects the victim's username (os.userInfo().username), hostname (os.hostname()), external IP address (fetched from ipify[.]org, myip[.]com, or ifconfig[.]me), configured DNS servers, and the package name/version. This data is hex-encoded, split into subdomain labels, and exfiltrated by performing a DNS resolution against the attacker-controlled domain s[.]3271df58[.]gfde[.]site — the DNS server at that domain receives the encoded system fingerprint, effectively tunneling the stolen data over DNS queries. The package presents a fully playable snake game as cover while the exfiltration runs in the background.