The @achuthvp/postinstall-poc npm package versions 1.0.0 through 1.0.3 include a postinstall.js script that executes the 'id' command to collect user and group identifiers, then sends this information along with hostname, platform, architecture, current working directory, and Node.js version to a hardcoded external webhook URL. This exfiltration occurs silently and unconditionally during installation, effectively performing reconnaissance on the host system. The package's README does not disclose this behavior. Due to this, any system with this package installed should be considered fully compromised, as attackers may have gained control or access to sensitive information.

Systems installing this package leak sensitive system identity information to an attacker-controlled endpoint. The compromise is severe enough that all secrets and keys on the affected system should be considered exposed and rotated immediately. Removing the package does not guarantee removal of all malicious artifacts or backdoors, indicating potential persistent compromise.

Remove the @achuthvp/postinstall-poc package immediately from all systems. Rotate all secrets, credentials, and keys that were present on affected systems using a separate, trusted environment. Because the package grants potential full control to an attacker, consider rebuilding or thoroughly auditing affected systems. No official patch or fix is available; avoidance and removal are the primary mitigations.