Malicious code in gpt-sdk (npm)

The gpt-sdk npm package versions 0.1.0 through 0.2.4 contain a postinstall.js script that runs unconditionally on npm install. This script gathers a wide range of installer-side reconnaissance data such as hostname, FQDN, /etc/hosts entries, Windows Active Directory environment variables, user profile details, VPN client signals, npm registry URL, and continuous integration repository identifiers. The collected information is concatenated into a query string and sent via plaintext HTTP GET to a remote IP address (http://46.224.67.169:3000/ping). The package's main module exports an empty object, indicating the postinstall beacon is the sole payload. The README misleadingly states that no data is collected. This is a classic supply-chain reconnaissance payload designed to map corporate networks, internal AD topology, and CI/CD environments of users installing the package.

The malicious postinstall script compromises user privacy and organizational security by exfiltrating sensitive environment and network configuration data to an attacker-controlled server. This reconnaissance data can facilitate targeted attacks against corporate networks, Active Directory infrastructures, and software development pipelines. Although no direct code execution beyond data collection is described, the exposure of internal network topology and CI/CD environment details poses a significant risk to affected organizations.

No official patch or remediation is currently documented. Users should immediately discontinue use of the gpt-sdk package versions 0.1.0 through 0.2.4 and remove it from their projects. Audit dependency trees for inclusion of this package and replace it with trusted alternatives. Monitor for any network connections to the indicated IP address and block outbound traffic to it if possible. Since the package's README falsely claims no data collection, do not trust package metadata alone. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.