The 'unreal-horde-dashboard' npm package at version 99999.0.0 contains malicious code that runs automatically on 'npm install' via a preinstall script. This script collects sensitive host information including hostname, username, current working directory, platform, Node.js version, npm user-agent, and environment variables matching credential-related patterns (e.g., AWS_, GITHUB_, GH_, NPM_, EPIC_, UE_, HORDE_, P4, CI, BUILD, TOKEN, KEY, SECRET). The collected data is sent in JSON format over unencrypted HTTP to a hardcoded IP address (http://109.123.247.172/npm/unreal_horde_dashboard). Additionally, it performs a DNS lookup to a crafted subdomain that encodes the installer identity, enabling out-of-band callbacks that can bypass HTTP egress restrictions. The package name and environment variable targeting indicate an intent to compromise Epic Games' Unreal Engine Horde build system through dependency confusion attacks. Installation on developer workstations or CI runners leads to leakage of various scoped secrets, effectively compromising the system.

Installation of this malicious package results in exfiltration of sensitive environment variables and host identifiers to an attacker-controlled server. This includes secrets related to AWS, GitHub, npm, Perforce, and Epic/Horde build systems. The compromise allows attackers to gain access to credentials and potentially take full control of the affected system. Due to the nature of the attack and the data exfiltrated, any system with this package installed should be considered fully compromised. Secrets must be rotated immediately from a secure environment. Removal of the package alone does not guarantee elimination of all malicious artifacts or backdoors.

No official patch or fix is available for this malicious package. The primary mitigation is to avoid installing 'unreal-horde-dashboard' version 99999.0.0 or any similarly suspicious versions. If this package has been installed, remove it immediately and consider the host fully compromised. Rotate all exposed secrets (AWS, GitHub, npm, Perforce, Epic/Horde tokens and keys) from a different, secure machine. Conduct a thorough investigation and remediation of the affected system, as removal of the package may not eliminate all malicious components. Monitor for any suspicious network activity related to the hardcoded IP or DNS callbacks described.