The gethandler-api npm package version 0.0.1 includes a postinstall script that unconditionally sends an HTTPS GET request to a third-party webhook URL containing sensitive environment information about the installer machine. This data includes the hostname, username, platform, current working directory, package name and version, CI environment indicators, and a timestamp. The package is described as a defensive typo-squat placeholder for the @getd/* namespace, but its behavior constitutes non-consensual data exfiltration and fingerprinting of users who mistakenly install it. According to the GHSA-malware source, any system with this package installed or running should be considered fully compromised, requiring immediate secret and key rotation from a separate machine. Removal of the package alone does not guarantee eradication of all malicious components.

Installation of the gethandler-api package version 0.0.1 results in the exfiltration of sensitive environment information to an external third party without user consent. This enables attackers to fingerprint and track machines that mistakenly install the package. The package presence indicates a full system compromise, potentially allowing attackers to access all secrets and keys stored on the affected computer. Consequently, this poses a severe risk to confidentiality and system integrity.

No official patch or fix is available for this malicious package. Immediate removal of the gethandler-api package version 0.0.1 is recommended. All secrets and keys stored on the affected machine should be rotated immediately from a separate, trusted device. Given the potential full compromise, further forensic analysis and system remediation may be necessary. Monitor for any signs of persistent malicious activity beyond the package removal.