The unscoped npm package 'getd-content-management' (version 0.0.1) impersonates the legitimate @getd/* scope and executes a postinstall.js script that collects sensitive host and environment information. This data includes os.hostname(), os.userInfo().username, os.platform(), process.cwd(), and CI-related environment variables (CI, BUILD_BUILDID, AGENT_NAME). The collected information is transmitted via an HTTPS GET request to a third-party request-capture service at https://webhook.site/18dc4281-d366-438a-9186-76fbcd56ade5. The script suppresses errors to avoid detection by the installer. According to the GHSA advisory, any system with this package installed should be considered fully compromised, requiring immediate secret rotation and thorough remediation beyond package removal.

Installation of this package results in exfiltration of sensitive internal host and environment data to an attacker-controlled endpoint. The presence of the package indicates a full compromise of the affected system, potentially exposing all stored secrets and keys. Attackers may have persistent access beyond the package itself, making the system untrustworthy until fully remediated.

No official patch or fix is available for this malicious package. The package should be immediately removed from any affected systems. All secrets, credentials, and keys stored on the compromised system must be rotated from a secure, uncompromised environment. Due to the likelihood of full system compromise, a comprehensive incident response and system rebuild is recommended. Monitor for any further suspicious activity related to this package or its artifacts.