The 'getd-pantallas-cliente' npm package (version 0.0.1) executes a post-install script that gathers sensitive system information including os.hostname(), os.userInfo().username, os.platform(), process.cwd(), and CI/build environment variables. This information is transmitted via HTTPS GET requests to an anonymous webhook.site URL, without disclosure or user consent. The package is a typosquat placeholder for the @getd/* scope, designed to fingerprint machines of users who mistype package names. According to the GHSA malware source, any system with this package installed should be considered fully compromised, with immediate rotation of all secrets and keys recommended. Removal of the package alone may not eliminate all malicious software introduced.

Unconsented exfiltration of system and environment information occurs upon installation, potentially exposing sensitive data. The package is considered malicious and may lead to full system compromise, requiring secret and key rotation. The presence of this package indicates a high risk of unauthorized access and control by an external entity.

Remove the 'getd-pantallas-cliente' package immediately. Rotate all secrets and keys stored on the affected machine from a separate, trusted device. Due to the potential full compromise, consider a full system audit and reinstallation if necessary. There is no official patch or fix; remediation involves removal and secret rotation.