The nat-ulid package version 3.0.2 includes a bundled file (dist/node/payload.js) with several POST call sites that may be used for data exfiltration. While pattern matching cannot definitively distinguish legitimate from malicious HTTP traffic, the presence of multiple POST requests in this context is suspicious. No direct evidence of credential theft or environment scraping was identified, but the package is flagged as malicious by the GHSA-malware source, indicating full compromise of affected systems. The package should be removed and secrets rotated, but full remediation may require additional incident response due to potential persistent compromise.

Any computer with nat-ulid version 3.0.2 installed or running should be considered fully compromised. Attackers may have gained full control, risking exposure of all stored secrets and keys. Simply removing the package may not remove all malicious artifacts, increasing the risk of ongoing unauthorized access.

Remove the nat-ulid package version 3.0.2 immediately from all affected systems. Rotate all secrets and keys from a separate, uncompromised system. Conduct a thorough incident response to identify and remediate any persistent malicious components beyond the package itself. Patch status is not applicable as this is a malicious package rather than a vulnerability with a vendor fix.