The 'getd-ui-library' npm package (version 0.0.1) includes a postinstall.js script that runs unconditionally upon installation. This script sends an HTTPS GET request to a hardcoded webhook.site URL, transmitting sensitive telemetry such as the installer's hostname, username, platform, current working directory, and continuous integration environment variables. The package name is designed to impersonate the legitimate '@getd/ui-library' scoped package, increasing the likelihood of accidental installation. According to the GHSA-malware source, any system with this package installed or running should be considered fully compromised, with all secrets and keys rotated immediately. Removal of the package alone may not eliminate all malicious software introduced.

Installation of this package results in exfiltration of sensitive system and environment information to an external attacker-controlled endpoint. The attacker gains telemetry useful for follow-on targeting, including CI build agent fingerprinting and developer host enumeration. The compromise is severe enough that the affected system should be treated as fully compromised, with all stored secrets and keys considered exposed. There is no guarantee that removing the package removes all malicious artifacts, indicating potential persistence or additional malware installation.

No official patch or fix is available. Immediate removal of the 'getd-ui-library' package version 0.0.1 is required. All secrets, credentials, and keys stored on the affected machine should be rotated from a separate, uncompromised device. Due to the high likelihood of full system compromise, consider rebuilding the affected system from a known good state. Exercise caution to avoid installing similarly named malicious packages by verifying package scope and source before installation.