The 'eslint-config-compact-utils' npm package versions 1.0.0 and 1.0.2 execute malicious code during module import that gathers host reconnaissance information including hostname, username, platform, architecture, Node.js version, current working directory, and CI/repository environment variables such as CI, RUNNER_NAME, and GITHUB_REPOSITORY. This data is sent as query parameters via HTTPS GET requests to a hardcoded AWS API Gateway endpoint (https://cbrsuo9293.execute-api.us-east-1.amazonaws.com/c). The exfiltration occurs as a side effect of importing the module, indicating the package is malicious and likely used for dependency confusion or typosquatting reconnaissance.

The malicious package leaks sensitive environment and host information to an attacker-controlled endpoint, potentially exposing internal CI/CD environment details and host identity. This can facilitate further targeted attacks or compromise of development environments relying on this package.

Users should immediately remove and replace 'eslint-config-compact-utils' versions 1.0.0 and 1.0.2 from their projects. Avoid installing or importing this package. Since no official patch or remediation is indicated, rely on package removal and verification of dependencies to prevent this malicious code execution.