The 'ghazaly' npm package version 99.9.0 includes a postinstall script that runs index.js, which executes system commands and gathers host information such as the current user, hostname, working directory, and network interfaces. This data is exfiltrated via HTTPS GET requests to a hardcoded Burp Collaborator subdomain, indicating malicious intent. The package metadata suggests it is a dependency confusion lure with suspicious versioning and dependency naming. The presence of this package on a system implies a full compromise, with potential persistent malicious control beyond just the package itself.

Any system with 'ghazaly' version 99.9.0 installed is considered fully compromised. The attacker gains access to sensitive host information and potentially full control over the system. All secrets and keys stored on the compromised system should be considered exposed and must be rotated immediately from a secure environment. Simply removing the package does not guarantee removal of all malicious components or backdoors.

Remove the 'ghazaly' package version 99.9.0 immediately from affected systems. Rotate all secrets, keys, and credentials that were stored or used on the compromised system from a different, secure computer. Conduct a thorough investigation for any persistent malicious activity or backdoors, as removal of the package alone may not fully remediate the compromise. Monitor for any unusual activity and consider rebuilding the system if full trust cannot be restored.