Skip to main content
Press slash or control plus K to focus the search. Use the arrow keys to navigate results and press enter to open a threat.
Reconnecting to live updates…

Malicious code in epic-internal-tools (npm)

0
High
Published: 07/02/2026 (07/02/2026, 21:32:03 UTC)
Source: GCVE Database
Product: epic-internal-tools

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c8936b0c0d22097170c5eb02c9b183611934e59e7a3c97f94e3a269e13f0d4d5) The package.json preinstall script auto-executes on `npm install` and performs installer-side reconnaissance and credential theft. It collects os.hostname(), username, cwd, platform, node version, npm user-agent, and CI indicators (GITHUB_ACTIONS, JENKINS_URL, TEAMCITY_VERSION, HORDE_AGENT), then enumerates process.env and selects up to 30 variables matching credential-shaped patterns (AWS_, GITHUB_, GH_, NPM_, EPIC_, UE_, HORDE_, P4, CI, BUILD, TOKEN, KEY, SECRET). The collected JSON is POSTed over plain HTTP to a hardcoded bare-IP endpoint at http://109.123.247.172/npm/epic_internal_tools. In parallel, it performs a DNS lookup against <host>-<user>.epic_internal_tools.npm.epic-dc.oast.fun, using an interactsh-style out-of-band collector to smuggle host and user identifiers via DNS as a covert channel that bypasses HTTP egress filtering. The package name `epic-internal-tools`, the sentinel version `99999.0.0`, and the Epic/Unreal/Horde/Perforce env-var targeting are the standard dependency-confusion pattern aimed at Epic Games internal build agents. Installing this package on a developer workstation or CI runner ships CI/cloud/registry credentials and host identity to attacker infrastructure. ## Source: ghsa-malware (cf37416af81dba8f2b8a2d792aa6f190551237d659204e17e2698f69fbb6d1b7) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. ## Source: ossf-package-analysis (8e96ac07cfb3a5132ff46542a6feca17f9b907b20596d713cd89063840ff2b47) The OpenSSF Package Analysis project identified 'epic-internal-tools' @ 99999.0.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

Affected software

npmghsa
epic-internal-tools
Affected versions
=99999.0.0

Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 07/10/2026, 11:45:17 UTC

Technical Analysis

The 'epic-internal-tools' npm package at version 99999.0.0 includes a preinstall script that runs automatically on 'npm install'. This script gathers detailed reconnaissance data such as hostname, username, current working directory, platform, Node.js version, npm user-agent, and continuous integration environment indicators. It enumerates environment variables and extracts up to 30 variables matching credential-related patterns (e.g., AWS_, GITHUB_, TOKEN, SECRET). The collected data is sent in JSON format over plain HTTP to a hardcoded IP address. Additionally, it performs a DNS lookup to a specially crafted domain to exfiltrate host and user identifiers via a covert DNS channel, bypassing HTTP egress filtering. The package is designed for dependency confusion attacks targeting Epic Games internal build agents but poses a risk to any system where installed, potentially leading to full system compromise and credential theft.

Potential Impact

Systems that install this package are at high risk of credential theft and system compromise. The malicious code exfiltrates sensitive environment variables and host information to attacker infrastructure, potentially exposing CI, cloud, and registry credentials. The presence of this package indicates a fully compromised system, and any secrets or keys stored on the affected machine should be considered compromised and rotated immediately. Removal of the package alone may not remove all malicious artifacts or backdoors.

Mitigation Recommendations

No official patch or fix is available for this malicious package. Immediate removal of the 'epic-internal-tools' package version 99999.0.0 is recommended. All credentials and secrets stored on affected systems should be rotated from a secure, uncompromised environment. Due to the potential for full system compromise, a thorough incident response and system rebuild may be necessary. Monitor for any signs of further compromise and avoid installing untrusted or suspicious packages, especially those mimicking internal tools.

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Gcve Source
db.gcve.eu
Osv Id
MAL-2026-6737
Osv Schema Version
1.7.4
Aliases
[]
Ecosystems
["npm"]
Database Specific Severity
null
Cvss Version
null

Threat ID: 6a46ecab27e9c7971943b717

Added to database: 07/02/2026, 22:56:43 UTC

Last enriched: 07/10/2026, 11:45:17 UTC

Last updated: 07/25/2026, 15:52:32 UTC

Views: 25

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses