The getd-eslint-rules npm package version 0.0.1 includes a postinstall script that automatically collects sensitive host identifiers and sends them to a remote collector URL without user consent. This exfiltration occurs silently during npm install, with errors suppressed. The package is designed as a 'defensive typo-squat' research artifact but effectively acts as malware by harvesting environment and system data. According to the GHSA advisory, any system with this package installed should be considered fully compromised, requiring immediate secret and key rotation and package removal. However, removal alone may not eliminate all malicious components due to potential full system compromise.

Installation of [email protected] results in unauthorized data exfiltration of host identifiers and environment details to a third-party server. The package's presence indicates likely full system compromise, risking exposure of all secrets and keys stored on the machine. Attackers may have gained persistent control, making remediation complex and urgent.

Remove the getd-eslint-rules package immediately. Rotate all secrets and keys stored on the affected system from a separate, trusted machine. Treat the compromised system as fully controlled by an attacker and consider rebuilding or thoroughly cleaning the environment. There is no official patch or fix; avoidance and removal are the only mitigations.