The 'getd-eslint-rules' npm package (version 0.0.1) includes a postinstall script that automatically collects host environment identifiers (os.hostname, os.userInfo username, os.platform, current working directory, CI environment variable, and package name/version) and sends them as query parameters in an HTTPS GET request to a hardcoded webhook.site URL. This exfiltration occurs silently during installation, with errors suppressed. Although the package claims to be a 'defensive typo-squat' research artifact, it effectively leaks sensitive environment information without consent. The package name is designed to catch users who mistype ESLint rules package names, increasing the likelihood of accidental installation. According to source advisories, any system with this package installed should be considered fully compromised, necessitating immediate secret/key rotation and removal of the package, though removal may not guarantee full remediation due to potential further compromise.

Installation of this package results in unauthorized exfiltration of host environment identifiers to an external collector. The package is considered fully compromising the affected system, implying potential unauthorized access or control. All secrets and keys stored on the compromised system should be rotated immediately. The presence of this package indicates a high risk of further malicious activity beyond the initial data exfiltration.

Remove the 'getd-eslint-rules' package immediately from all affected systems. Rotate all secrets and keys stored on the compromised systems from a separate, trusted environment. Due to the potential for full system compromise, further forensic analysis and remediation may be necessary. No official patch or fix is available; the package should be avoided entirely. Monitor for any signs of persistent compromise.