The 'developer-dashboard' npm package versions 1.0.2 and 1.0.3 contain heavily obfuscated malicious code that steals sensitive user data including Discord tokens, saved logins, MFA codes, payment methods, and metadata. It also scrapes cookies and data from Roblox, Steam, and Telegram. The stolen data is exfiltrated via a hardcoded Discord webhook. The package includes an Electron session injection module to intercept Discord authentication and downloads a portable Python runtime to execute additional malicious scripts. It employs anti-analysis techniques to evade detection on researcher machines. Any system with this package installed should be considered fully compromised.