umi-preset-rce-jytest@1.0.1

Analysis

An Umi.js build plugin that harvests system and environment information during the build phase. When a project using this dependency is built, the plugin executes shell commands to collect: hostname, username, current working directory, Node/npm versions, the full environment variable listing (capturing any CI/CD tokens such as NPM_TOKEN, GITHUB_TOKEN, or AWS credentials present in the environment), network configuration, process list, disk usage, network connections, /etc/passwd (first 20 lines), and /etc/hosts. All collected data is written to a file named rce-debug.log in the build output directories (dist, build, out, output, public). Additionally, the data is base64-encoded and injected as an HTML comment (prefixed JYRCE::) into every .html file in those directories. No outbound network traffic was observed from this package itself; the stolen data is exfiltrated through contaminated build artifacts.