The 'developer-dashboard' npm package (versions 1.0.2 and 1.0.3) contains a heavily obfuscated single-file payload that harvests a wide range of sensitive data including Discord tokens, MFA/backup codes, saved payment methods, and account metadata. It also scrapes cookies and data from Roblox, Steam, and Telegram. The payload prepends system hostname and username to the stolen data and exfiltrates it via a hardcoded Discord webhook URL. An embedded Electron session.webRequest injection module hooks key Discord authentication endpoints to intercept login credentials in-app. Additionally, the package downloads and extracts a portable Python 3.10 runtime and executes a generated temporary script, functioning as an alternate runtime dropper unrelated to the dashboard functionality. Anti-analysis code detects blacklisted hostnames, usernames, and analyst tools to avoid execution in research environments. Due to the extensive data theft and persistence mechanisms, any system with this package installed should be considered fully compromised.

Systems with the affected package installed are at high risk of full compromise. Sensitive credentials and tokens for Discord, Roblox, Steam, Telegram, and payment services can be stolen, enabling unauthorized access and potential account takeover. The malware also executes additional code via a dropped Python runtime, increasing persistence and attack surface. Removal of the package alone may not eliminate all malicious components, as full control may have been granted to attackers.

Immediate removal of the 'developer-dashboard' package versions 1.0.2 and 1.0.3 is required. All secrets, tokens, and keys stored on the compromised system should be rotated from a separate, trusted device. Because the package installs additional malicious components and may grant full system control to attackers, a full system forensic analysis and potential rebuild is recommended. No official patch or fix is available; users should avoid these versions entirely.