The 'akshajrawat.utils' npm package declares a postinstall lifecycle hook in its package.json that runs automatically on 'npm install'. This hook executes a Node.js command that sends an HTTPS GET request to 'https://example.com/collect', including the installer's environment variables HOME and USERNAME in the query string. This unconditional outbound transmission of installer-side identifiers is a canonical supply-chain exfiltration pattern. While the example.com domain and package description suggest a proof-of-concept, the underlying behavior is malicious and would compromise any system installing this package. The same code scaffold can be redirected to attacker-controlled hosts to exfiltrate sensitive information.

Any computer that installs or runs this package is considered fully compromised due to the exfiltration of environment variables that may include sensitive information. The presence of this package indicates a supply-chain compromise, and all secrets and keys stored on the affected system should be rotated immediately from a separate, trusted device. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors that may have been installed as a result.

No official patch or fix is available. The package should be removed immediately from any affected system. All secrets and credentials potentially exposed should be rotated from a different, secure computer. Exercise caution when installing npm packages, especially those not from trusted sources. Monitor for similar postinstall scripts in dependencies to prevent supply-chain exfiltration.