The 'getd-web-corporativa' npm package (version 0.0.1) executes a postinstall script that performs an HTTPS GET request to a hardcoded webhook.site URL, transmitting sensitive environment information such as the installer's hostname, OS username, platform, current working directory, package name/version, CI/build indicators, and a timestamp via URL query parameters. The data is sent to a public webhook collector accessible by anyone with the UUID path, enabling unauthenticated host reconnaissance. The package is published unscoped by 'jplopezy' with no repository or legitimate homepage and contains no other functionality beyond this telemetry. Errors during this process are suppressed, making the installation appear successful. According to the GHSA malware source, any system with this package installed or running should be considered fully compromised, necessitating immediate secret/key rotation and removal of the package, though full remediation cannot be guaranteed.

Sensitive environment and identity data from the installer's system is exfiltrated to a publicly accessible endpoint without consent, enabling attackers to perform host reconnaissance for potential follow-on attacks. The package's presence indicates a full system compromise risk, potentially exposing all secrets and keys stored on the affected computer. Removal of the package alone may not eliminate all malicious software introduced.

No official patch or fix is available. Immediate removal of the 'getd-web-corporativa' package version 0.0.1 is recommended. All secrets and keys stored on the affected system should be rotated from a separate, trusted device. Due to the potential full compromise, further forensic analysis and remediation may be necessary. Monitor for any signs of persistent malicious activity.