ug-env-switch-ball@7.9.9

Analysis

The preinstall script (node check-environment.js) runs initSystem() which exfiltrates system information via DNS. It collects the victim's OS username, hostname, public IP address (fetched from api[.]ipify[.]org, api[.]myip[.]com, or ifconfig[.]me), DNS server addresses, and package metadata. This data is hex-encoded, split into chunks, and exfiltrated as subdomains of s[.]3271df58[.]gfde[.]site via DNS resolution queries (dns.resolve4). The publisher address (gfde[.]site) shares the same domain as the exfiltration endpoint.