The 'getd-transactional-web' npm package (version 0.0.1) executes a post-installation script that performs an HTTPS GET request to a third-party webhook URL, transmitting sensitive environment and system information including hostname, username, platform, current working directory, CI environment variables, and package metadata. This exfiltration occurs silently without user consent to an endpoint not controlled by the package publisher, effectively acting as a malicious beacon. The package name is designed to attract users targeting the '@getd' namespace, increasing the risk of inadvertent installation. Security sources classify any machine with this package installed as fully compromised, recommending immediate secret rotation and package removal.

Installation of this package results in unauthorized disclosure of system and environment information to an anonymous third party, potentially enabling further compromise. The package's presence indicates full system compromise, necessitating immediate secret and key rotation. Removal of the package alone may not eliminate all malicious artifacts or control established by the attacker.

Remove the 'getd-transactional-web' package immediately from affected systems. Rotate all secrets and keys stored on the compromised machine from a separate, secure device. Due to the potential for full system compromise, consider a full system audit or rebuild. No official patch or fix is available; remediation relies on removal and secret rotation.