epic-internal-tools@99999.0.0

Analysis

The package epic-internal-tools@99999.0.0 is a dependency-confusion credential stealer. Its preinstall hook collects host metadata (hostname, username, cwd, platform, architecture, Node.js version, CI environment variables) and filters process.env for credential patterns matching AWS_*, GITHUB_*, GH_*, NPM_*, EPIC_*, UE_*, HORDE_*, P4, CI, BUILD, TOKEN, KEY, and SECRET — collecting up to 30 such entries. The assembled payload is POSTed as JSON to hxxp://109[.]123[.]247[.]172/npm/epic_internal_tools. Additionally, the script performs a DNS callback to {hostname}-{username}.epic_internal_tools.npm[.]epic-dc[.]oast[.]fun, using the oast[.]fun exfiltration callback service. The package's main file (index.js) is a stub that exports an empty object — the sole purpose of the package is the preinstall credential-theft payload.