Malicious code in ue-jenkins-buildkite (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f3f4ff9ea00766589ae9dece7648aa4ce29ac9bc82173fce0a1adefaeb6c8f5a) [email protected] is a dependency-confusion package targeting an internal Epic Games / Unreal Engine CI namespace (name evokes Jenkins/Buildkite tooling; version 99999.0.0 is the canonical shape used to win private-registry resolution). Its package.json preinstall script runs automatically on npm install and performs installer-side credential harvest: it collects os.hostname(), username, cwd, platform, and arch; probes CI-specific environment variables (HORDE_AGENT, GITHUB_ACTIONS, JENKINS_URL, TEAMCITY_VERSION); and enumerates process.env filtering by the regex /^(AWS_|GITHUB_|GH_|NPM_|EPIC_|UE_|HORDE_|P4|CI|BUILD|TOKEN|KEY|SECRET)/i, taking up to 30 matching variables. The collected data is POSTed as JSON over plain HTTP to the bare-IP endpoint http://109.123.247.172/npm/ue_jenkins_buildkite, and an out-of-band DNS beacon is issued to <host>-<user>.ue_jenkins_buildkite.npm.epic-dc.oast.fun. The regex is a credential-shaped bulk scraper (AWS keys, GitHub tokens, npm publish tokens, generic *TOKEN*/*KEY*/*SECRET* variables) unrelated to any legitimate build-tool license check. ## Source: ghsa-malware (55fd457fdd033f752d6550cdd66a9f0d98348f07c118af4e5f75a4eb9948b7d2) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. ## Source: ossf-package-analysis (a67a3300cb2357e9661889459167d34c43be7925bd3d476d3a08588d9a907b59) The OpenSSF Package Analysis project identified 'ue-jenkins-buildkite' @ 99999.0.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.
AI Analysis
Technical Summary
The 'ue-jenkins-buildkite' npm package at version 99999.0.0 is identified as malicious. It uses a dependency confusion technique to impersonate an internal Epic Games/Unreal Engine CI package. Upon installation, its preinstall script harvests environment variables matching credential-related patterns (e.g., AWS keys, GitHub tokens, npm tokens) and system information such as hostname, username, platform, and current working directory. This data is sent unencrypted via HTTP POST to a remote IP address and also triggers DNS queries to attacker-controlled domains. The package's behavior indicates it is designed for credential harvesting and potential system compromise.
Potential Impact
Any system that installs or runs this package is considered fully compromised. Sensitive credentials and environment secrets may be stolen and transmitted to an attacker-controlled server. This can lead to unauthorized access to cloud services, source code repositories, CI/CD pipelines, and other critical infrastructure. Because the package grants the attacker potential full control, simply removing the package does not guarantee remediation. All secrets and keys on the affected system should be rotated immediately from a secure environment.
Mitigation Recommendations
No official patch or fix is available since this is a malicious package rather than a vulnerability in legitimate software. The package should be removed immediately if found installed. All credentials and secrets exposed on the affected system must be rotated from a different, uncompromised machine. Users and organizations should audit their package dependencies to prevent dependency confusion attacks and avoid installing packages with suspicious or unusually high version numbers. Monitoring for unexpected network traffic to suspicious IPs or domains related to this package is recommended.
Malicious code in ue-jenkins-buildkite (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f3f4ff9ea00766589ae9dece7648aa4ce29ac9bc82173fce0a1adefaeb6c8f5a) [email protected] is a dependency-confusion package targeting an internal Epic Games / Unreal Engine CI namespace (name evokes Jenkins/Buildkite tooling; version 99999.0.0 is the canonical shape used to win private-registry resolution). Its package.json preinstall script runs automatically on npm install and performs installer-side credential harvest: it collects os.hostname(), username, cwd, platform, and arch; probes CI-specific environment variables (HORDE_AGENT, GITHUB_ACTIONS, JENKINS_URL, TEAMCITY_VERSION); and enumerates process.env filtering by the regex /^(AWS_|GITHUB_|GH_|NPM_|EPIC_|UE_|HORDE_|P4|CI|BUILD|TOKEN|KEY|SECRET)/i, taking up to 30 matching variables. The collected data is POSTed as JSON over plain HTTP to the bare-IP endpoint http://109.123.247.172/npm/ue_jenkins_buildkite, and an out-of-band DNS beacon is issued to <host>-<user>.ue_jenkins_buildkite.npm.epic-dc.oast.fun. The regex is a credential-shaped bulk scraper (AWS keys, GitHub tokens, npm publish tokens, generic *TOKEN*/*KEY*/*SECRET* variables) unrelated to any legitimate build-tool license check. ## Source: ghsa-malware (55fd457fdd033f752d6550cdd66a9f0d98348f07c118af4e5f75a4eb9948b7d2) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. ## Source: ossf-package-analysis (a67a3300cb2357e9661889459167d34c43be7925bd3d476d3a08588d9a907b59) The OpenSSF Package Analysis project identified 'ue-jenkins-buildkite' @ 99999.0.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'ue-jenkins-buildkite' npm package at version 99999.0.0 is identified as malicious. It uses a dependency confusion technique to impersonate an internal Epic Games/Unreal Engine CI package. Upon installation, its preinstall script harvests environment variables matching credential-related patterns (e.g., AWS keys, GitHub tokens, npm tokens) and system information such as hostname, username, platform, and current working directory. This data is sent unencrypted via HTTP POST to a remote IP address and also triggers DNS queries to attacker-controlled domains. The package's behavior indicates it is designed for credential harvesting and potential system compromise.
Potential Impact
Any system that installs or runs this package is considered fully compromised. Sensitive credentials and environment secrets may be stolen and transmitted to an attacker-controlled server. This can lead to unauthorized access to cloud services, source code repositories, CI/CD pipelines, and other critical infrastructure. Because the package grants the attacker potential full control, simply removing the package does not guarantee remediation. All secrets and keys on the affected system should be rotated immediately from a secure environment.
Mitigation Recommendations
No official patch or fix is available since this is a malicious package rather than a vulnerability in legitimate software. The package should be removed immediately if found installed. All credentials and secrets exposed on the affected system must be rotated from a different, uncompromised machine. Users and organizations should audit their package dependencies to prevent dependency confusion attacks and avoid installing packages with suspicious or unusually high version numbers. Monitoring for unexpected network traffic to suspicious IPs or domains related to this package is recommended.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-6731
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a46ecad27e9c7971943b894
Added to database: 07/02/2026, 22:56:45 UTC
Last enriched: 07/10/2026, 11:44:42 UTC
Last updated: 07/30/2026, 21:22:26 UTC
Views: 37
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.