The 'gethandler-api' npm package version 0.0.1 includes a postinstall script that unconditionally sends an HTTPS GET request to a third-party webhook URL containing the installer's hostname, username, platform, current working directory, package name/version, CI environment indicators, and a timestamp. This silent data exfiltration occurs without user consent and is designed to fingerprint users who mistakenly install this typosquatted package. The package self-describes as a defensive typo-squat placeholder for the @getd/* namespace, but the beaconing behavior exposes sensitive environment details to any party with access to the webhook URL. According to the source, any computer with this package installed should be considered fully compromised, with immediate rotation of all secrets and keys recommended.

Installation of this package results in non-consensual exfiltration of sensitive environment and user information to a third party, enabling fingerprinting of affected systems. The package is considered fully compromising the host, potentially allowing an attacker full control. Secrets and keys stored on the compromised system are at risk and should be rotated immediately. Removal of the package alone does not guarantee eradication of all malicious software introduced.

No official patch or fix is available. Immediate removal of the 'gethandler-api' package version 0.0.1 is recommended. Systems with this package installed should be treated as fully compromised. All secrets and keys stored on the affected systems must be rotated from a separate, trusted environment. Monitor for any signs of further compromise and consider full system remediation or rebuild.