The @medisend/shared npm package version 0.0.1-security-research includes a postinstall lifecycle script that runs a curl command at install time. This command transmits the hostname of the installing machine as a query parameter to a third-party webhook collector. The beacon URL contains a placeholder for a receiver ID, indicating incomplete configuration, but the script still executes and leaks host identification. This behavior aligns with reconnaissance or dependency-confusion attack patterns rather than benign functionality. The package is considered malicious, and any system with it installed is presumed fully compromised.

Installation of this package results in an immediate outbound network request exposing the installer's hostname to an external entity. The presence of this malicious code indicates a high likelihood of full system compromise. Attackers may have gained control over the affected system, potentially accessing secrets and keys stored on it. Consequently, all credentials on compromised systems should be rotated. Removal of the package alone may not eliminate all malicious components or backdoors introduced.

Remove the @medisend/shared package version 0.0.1-security-research immediately from all affected systems. Consider all systems with this package installed as fully compromised. Rotate all secrets and keys stored on those systems from a separate, trusted environment. Due to the potential for persistent compromise, conduct a thorough investigation and remediation beyond package removal. No official patch or fix is available; the package itself is malicious.