The @medisend/auth npm package version =0.0.1-security-research includes a postinstall lifecycle script that automatically runs upon npm install. This script uses curl to send the installer's hostname as a query parameter to a webhook.site URL controlled by an attacker. This behavior is consistent with dependency confusion beaconing against an internal namespace. According to the ghsa-malware source, any system with this package installed or running should be considered fully compromised, with all secrets and keys needing immediate rotation from a different machine. Removal of the package alone may not eliminate all malicious software introduced.

Installation of the malicious @medisend/auth package results in the transmission of the installer's hostname to an attacker-controlled endpoint, indicating potential reconnaissance or tracking. The package's presence implies full system compromise, risking exposure of all stored secrets and keys. Attackers may have established persistent control beyond the package itself, making remediation complex and urgent.

Remove the @medisend/auth package version =0.0.1-security-research immediately. Rotate all secrets and keys stored on the compromised system from a separate, trusted machine. Because full system compromise is likely, conduct a thorough incident response to identify and remove any additional malicious software or backdoors. Monitor for any suspicious activity related to this compromise.