unreal-horde-dashboard@99999.0.0

Analysis

The preinstall hook in package.json runs a Node.js script that collects the victim's hostname, username, working directory, operating system, CPU architecture, Node.js version, npm agent, CI/CD environment variables, and environment variables matching credential patterns (AWS_, GITHUB_, GH_, NPM_, EPIC_, UE_, HORDE_, P4, CI, BUILD, TOKEN, KEY, SECRET). The collected data is serialized as JSON and exfiltrated via HTTP POST to 109[.]123[.]247[.]172 on port 80 at /npm/unreal_horde_dashboard, and via a DNS lookup to <hostname>-<username>.unreal_horde_dashboard.npm[.]epic-dc[.]oast[.]fun. The package contains no functional code — index.js is a stub exporting an empty object. The version 99999.0.0 and "Internal package" description are dependency-confusion indicators.