The 'canary-ci-test' npm package version 1.0.0 includes a postinstall lifecycle script that collects sensitive host information (os.hostname(), os.userInfo().username, process.cwd(), platform, DNS resolution) and sends it as JSON via an HTTPS POST request to a hardcoded endpoint (https://opgelost.nu/). This exfiltration occurs automatically during installation with no user opt-in and no visible indication, matching a classic install-time phone-home malicious pattern. The package metadata claims it is a scanner test fixture, but the actual code performs functional data exfiltration against any machine installing it. The compromise is severe enough that any machine with this package installed should be treated as fully compromised.

The malicious postinstall script exfiltrates sensitive host identifiers to an external server without user consent or awareness. This compromises the confidentiality of the affected system's environment. According to the source advisory, any computer with this package installed or running should be considered fully compromised, implying potential unauthorized control or further malicious activity. All secrets and keys stored on the compromised machine should be rotated immediately from a separate, trusted system. Removing the package alone may not fully remediate the compromise due to possible additional malware installed.

No official patch or fix is available for this malicious package. The recommended mitigation is to immediately remove the 'canary-ci-test' package version 1.0.0 from all affected systems. Treat any system with this package installed as fully compromised. Rotate all secrets, credentials, and keys stored on the affected systems from a different, secure machine. Conduct a thorough security assessment to identify and remediate any additional malicious software or backdoors that may have been installed. Monitor for any suspicious activity related to this compromise.