The 'gaarf' npm package version 3.2.1 includes a postinstall lifecycle script that executes automatically upon installation. This script collects system information including hostname, platform, architecture, Node.js version, package name, and lifecycle event. It then sends this data via an HTTP POST request to a hardcoded external endpoint (n8wx863s.instances.poc.jchunt.top/gaarf). The package name is similar to 'google/ads-api-report-fetcher', suggesting that victims are users who mistakenly install 'gaarf' instead of the legitimate package. This results in unintended data leakage to a third-party server.

The malicious postinstall script leaks host identifiers and environment details to an unauthorized external server. This compromises user privacy and may aid attackers in profiling or targeting affected systems. There is no indication of further exploitation or code execution beyond data exfiltration. No known active exploits have been reported in the wild.

No official patch or remediation is currently documented. Users should avoid installing the 'gaarf' package version 3.2.1. Verify package names carefully before installation to prevent typosquatting. Consider removing the package if already installed and monitor for suspicious network activity related to the described endpoint. Patch status is not yet confirmed — check the vendor advisory or npm registry for updates.