The 'getd-typescript-eslint-rules' npm package (version 0.0.1) contains malicious code in its postinstall.js script that collects the installer's hostname, OS username, platform, current working directory, CI environment variables, and package metadata. This information is sent via HTTPS GET requests to a hardcoded webhook.site URL. The package is a typosquat targeting '@getd/typescript-eslint-rules' and attempts to disguise its behavior as defensive security research. The script suppresses errors to avoid interrupting installation, enabling silent data exfiltration. According to the source ghsa-malware, any system with this package installed should be considered fully compromised, necessitating immediate secret rotation and package removal.

Installation of this package results in unauthorized data exfiltration of environment and system information to a third-party endpoint. The compromise is severe enough that affected systems are considered fully compromised, with potential exposure of all stored secrets and keys. Removal of the package alone may not eliminate all malicious artifacts or control established by the attacker.

Remove the 'getd-typescript-eslint-rules' package immediately from all affected systems. Rotate all secrets, keys, and credentials that were stored or accessible on compromised machines using a separate, trusted system. Due to the severity and potential persistence of the compromise, consider full system reimaging or forensic analysis. No official patch or fix is available; remediation relies on removal and secret rotation.