rtc-integration-frontend-sdk@99.9.0

Analysis

On install, the postinstall hook (node index.js) executes a host-reconnaissance script. It collects the system's hostname, OS platform and architecture, username, private IP addresses, public IP (queried from api[.]ipify[.]org), current working directory, and package name, then exfiltrates all of this data to a hardcoded Discord webhook URL (discord[.]com/api/webhooks/1524917003394089029/...). The webhook URL is the C2 endpoint for data exfiltration.