The 'getd-transactional-web' npm package version 0.0.1 executes a postinstall.js script that issues an HTTPS GET request to a third-party anonymous webhook URL, transmitting sensitive system and environment information without user consent. This data exfiltration includes os.hostname(), os.userInfo().username, os.platform(), process.cwd(), and continuous integration environment indicators. The package's README claims a defensive purpose, but the actual behavior aligns with malicious typosquatting tactics designed to collect installer metadata. The package is considered fully compromising any host on which it is installed, necessitating immediate secret/key rotation and thorough system remediation beyond mere package removal.

Installation of this package results in unauthorized exfiltration of sensitive system and environment information to an unaffiliated third party. The package's presence indicates a full compromise of the host system, potentially allowing attackers to gain control and access stored secrets and keys. This undermines system confidentiality and integrity, posing a significant security risk to affected environments.

No official patch or fix is available for this malicious package. Immediate removal of the 'getd-transactional-web' package version 0.0.1 is recommended. Due to the potential full system compromise, all secrets and keys stored on the affected machine should be rotated immediately from a separate, trusted system. Comprehensive system investigation and remediation should be conducted to ensure removal of any additional malicious artifacts beyond the package itself.