The 'field-plus' npm package versions 99.99.1 and 99.99.2 include malicious preinstall and postinstall scripts that execute a curl command to a hardcoded HTTP endpoint, transmitting sensitive environment details of the installer. The package tarball contains only a package.json file without the declared main index.js, indicating no legitimate functionality. This behavior is consistent with a dependency-confusion or namespace-squatting attack designed to identify organizations resolving internal package names from the public registry. According to the GHSA advisory, any system with this package installed should be considered fully compromised, necessitating secret rotation and package removal.

Installation of the malicious 'field-plus' package results in the exfiltration of sensitive system information to an attacker-controlled server. The package's presence indicates a high likelihood of full system compromise, potentially allowing attackers to access all secrets and keys stored on the affected computer. Removal of the package alone may not eliminate all malicious artifacts or backdoors introduced during installation.

No official patch or fix is available for this malicious package. Immediate removal of the 'field-plus' package versions 99.99.1 and 99.99.2 is required. All secrets, keys, and credentials stored on the affected system should be rotated from a trusted, uncompromised environment. Monitor for any signs of persistent compromise and consider a full system forensic analysis and rebuild if necessary.