The '@medisend/webview-bridge' npm package versions 0.0.1-security-research and 0.0.2-security-research include a postinstall lifecycle script that executes a curl command to a malicious webhook URL. This script exfiltrates environment details including the username, hostname, current directory, directory listing, and Node.js version to an attacker-controlled endpoint. The package is identified as malicious by multiple sources including Amazon Inspector, GHSA malware advisories, and the OpenSSF Package Analysis project. The malicious behavior is triggered automatically during installation if the package is resolved from the public npm registry, potentially due to dependency confusion in internal tooling.

Any system that installs or runs this package is considered fully compromised. The attacker gains access to sensitive environment information and potentially full control of the affected system. All secrets and keys stored on the compromised system should be rotated immediately from a separate, trusted environment. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors installed by the package.

Immediate removal of the '@medisend/webview-bridge' package versions 0.0.1-security-research and 0.0.2-security-research is recommended. All secrets and credentials on affected systems should be rotated from a secure, uncompromised environment. Due to the high risk of full system compromise, consider rebuilding or thoroughly auditing affected systems. There is no official patch or fix available; the package itself is malicious and should not be used. Avoid resolving internal packages from the public npm registry to prevent dependency confusion attacks.