The getd-web-corporativa npm package version 0.0.1 includes a postinstall script that performs an HTTPS GET request to a hardcoded webhook.site URL, exfiltrating sensitive host and environment information via URL query parameters. This includes hostname, OS username, platform, current working directory, package name and version, CI/build environment indicators, and a timestamp. The request is made silently with errors suppressed, making the malicious activity stealthy. The package is published by a defensive-squat user with no legitimate repository or homepage, and its name is designed to resemble the @getd scope to deceive users. The collected data is sent to a public webhook collector accessible to anyone with the UUID path, enabling unauthenticated reconnaissance for potential follow-on attacks. The package itself provides no legitimate functionality and is purely malicious. According to the GHSA advisory, any system with this package installed should be considered fully compromised, with immediate secret/key rotation recommended from a different machine. Removal of the package may not guarantee full remediation due to potential further compromise.

Installation of this package results in unauthorized exfiltration of sensitive host environment data to a public endpoint, enabling attackers to gather reconnaissance information for follow-on targeting. The presence of this package on a system indicates a full compromise, potentially allowing attackers to access secrets and keys stored on the machine. The malicious code executes silently during installation, increasing the risk of unnoticed compromise. Because the package author is a defensive squatter with no legitimate repository or homepage, trust in the package is invalid. The compromise may extend beyond the package itself, as attackers could have deployed additional malicious software after initial infection.

No official patch or fix is available for this malicious package. The recommended mitigation is to immediately remove the getd-web-corporativa package version 0.0.1 from affected systems. All secrets, keys, and credentials stored on the compromised machine should be rotated from a separate, trusted environment. Due to the likelihood of full system compromise, further forensic analysis and remediation may be necessary. Users should avoid installing untrusted or suspicious npm packages, especially those lacking legitimate repositories or publisher information. Monitor for any signs of additional compromise beyond the presence of this package.