robomerge@99999.0.0

Analysis

A dependency-confusion package impersonating Epic Games' internal robomerge tool. On install, the preinstall hook sends the victim's hostname, username, cwd, platform, architecture, and node version to hxxp://109[.]123[.]247[.]172/npm/robomerge via HTTP POST. It also collects up to 30 environment variables matching credential/crypto-key patterns (AWS_, GITHUB_, GH_, NPM_, EPIC_, UE_, TOKEN, KEY, SECRET, etc.) and exfiltrates them to the same endpoint. Additionally, a DNS callback is sent to <hostname>-<username>.robomerge[.]npm[.]epic-dc[.]oast[.]fun via dns.lookup. The package's index.js is a 20-byte stub; the only executable code is the exfiltration payload.