The 'gaarf-node' npm package (version 1.0.0) impersonates Google's ads-api-report-fetcher project but contains a malicious postinstall script. This script automatically runs on npm install and collects host identifiers including hostname, platform, architecture, Node.js version, package name, and npm lifecycle event. It then sends this information as JSON to a hardcoded remote host at ze0buq23.instances.poc.jchunt.top under the path /gaarf-node. The package.json self-labels as a 'Security research canary,' but the remote domain is unrelated to the legitimate project it impersonates. This data exfiltration occurs without user consent as a lifecycle side effect of installation.

The malicious postinstall script leads to unauthorized collection and transmission of host system identifiers to a remote server. This compromises user privacy and may facilitate further targeted attacks or reconnaissance by threat actors. No direct evidence of further exploitation or payload delivery is provided.

No official patch or remediation is currently documented. Users should avoid installing 'gaarf-node' version 1.0.0. Verify package authenticity before installation and prefer official sources. Monitor for updates or vendor advisories for remediation guidance. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.