The 'kalasnik-npm-simple-test' npm package version 1.0.0 includes a postinstall script named send_data.js that automatically runs on npm install. This script reads the file C:\temp\test.txt from the installer's filesystem and transmits its contents via plain HTTP to a hardcoded remote endpoint at IP 35.178.197.251 on port 8080. The package metadata suggests it is a proof-of-concept exfiltration tool rather than a legitimate library. Due to this behavior, any system with this package installed should be considered fully compromised.

Systems that install this package are at high risk of data exfiltration, as the postinstall script sends local file contents to an attacker-controlled server. This compromises confidentiality and potentially integrity of the host system. The presence of this package indicates a full compromise, and all secrets and keys stored on the system should be considered exposed and rotated immediately.

Remove the 'kalasnik-npm-simple-test' package immediately. Rotate all secrets and keys from a separate, uncompromised system. Because the package grants potential full control to an attacker, simply removing it may not fully remediate the compromise; a full system investigation and potential rebuild is recommended.