The 'localize-translate' npm package version 1.0.0 includes a postinstall lifecycle script that collects installer host information (hostname, platform, architecture, Node.js version, package name, timestamp, and npm lifecycle event) and transmits it via HTTP POST to a hardcoded external endpoint (gigww0v7.instances.poc.jchunt.top/localize-translate). This transmission occurs automatically on every installation and is not disclosed to the user. The collected data is limited to host identity information and does not include credentials, filesystem data, or environment variables. The behavior is indicative of malicious reconnaissance activity embedded in the package.

The impact involves unauthorized data exfiltration of host identifiers during package installation, potentially compromising user privacy and revealing environment details to a third party without consent. Although no credentials or sensitive filesystem data are collected, the unconditional and undisclosed nature of the data transmission constitutes a privacy and security risk.

No official patch or remediation is currently available for this package version. Users should avoid installing 'localize-translate' version 1.0.0. Consider removing the package if already installed. Monitor for updates or advisories from the package maintainers or npm registry. Employ supply chain security best practices such as verifying package integrity and using trusted sources.