tdhg-demp@1.0.0

Analysis

tdhg-demp@1.0.0 is a trojanized snake game. The package ships legitimate game code as cover, but both the npm preinstall lifecycle hook (check-environment.js) and the game constructor call a hex-obfuscated function (initSystem in utils.js). At install time and runtime, the function collects the victim's system fingerprint (username via os.userInfo().username, hostname via os.hostname(), external IP via api[.]ipify[.]org / api[.]myip[.]com / ifconfig[.]me, and DNS server configuration), hex-encodes it, and exfiltrates the data by crafting a DNS A-record lookup to the subdomain pattern `<hex-encoded-fingerprint>.c535bfb2[.]gfde[.]site`. The DNS query leaks the collected data to the DNS server for gfde[.]site. The publisher's email address uses the same gfde[.]site domain.