The getd-typescript-eslint-rules npm package (version 0.0.1) contains malicious code in its postinstall.js script that collects detailed environment information from the installer, including hostname, OS username, platform, current working directory, and CI environment markers. This data is exfiltrated via an HTTPS GET request to a hardcoded webhook.site URL. The package is a typosquat targeting @getd/typescript-eslint-rules and disguises its beaconing as 'defensive security research.' The malicious behavior occurs silently without causing installation failures. According to the GHSA advisory, any system with this package installed should be considered fully compromised, requiring immediate secret and key rotation and removal of the package, though full remediation is uncertain.

Systems that install this package leak sensitive environment and CI metadata to an external third-party endpoint, potentially exposing internal infrastructure details. The advisory states that any computer with this package installed should be considered fully compromised, implying possible further malicious control or persistence beyond the initial data exfiltration. Secrets and keys stored on the compromised system are at risk and must be rotated immediately. Removal of the package alone may not remove all malicious components introduced.

Immediate removal of the getd-typescript-eslint-rules package version 0.0.1 is required. All secrets and keys stored on the affected system should be rotated from a separate, trusted machine. Due to the potential full compromise of the system, consider rebuilding or thoroughly auditing the affected environment. No official patch or fix exists as this is a malicious package rather than a vulnerability in legitimate software. Avoid installing packages from untrusted or suspicious sources, especially typosquats.