The @medisend/core npm package version 0.0.1-security-research declares a postinstall lifecycle script that executes a curl command to transmit the installer's hostname to a webhook.site URL controlled by an attacker. This behavior leaks host identifiers off-host during installation. The package targets internal builds expecting a private @medisend/core package, exploiting dependency confusion to run this malicious code automatically. According to the GHSA-malware source, any system with this package installed or running should be considered fully compromised, with potential full control given to an external entity. Secrets and keys on affected systems must be rotated, and removal of the package alone may not remove all malicious artifacts.

Installation of this package results in unauthorized exfiltration of the installer's hostname to an attacker-controlled endpoint. The package's postinstall script executes automatically, potentially leading to full system compromise. Attackers may gain control over the affected system, risking exposure of all stored secrets and keys. The compromise is severe enough that affected systems should be treated as fully compromised, requiring secret rotation and thorough remediation beyond package removal.

No official patch or fix is available for this malicious package. The recommended mitigation is to immediately remove the @medisend/core package version 0.0.1-security-research from any affected systems. Treat any system with this package installed as fully compromised and rotate all secrets and keys from a separate, trusted system. Monitor for any signs of persistent compromise and consider full system remediation. Avoid installing packages from untrusted or unexpected sources, especially those mimicking private packages to prevent dependency confusion attacks.