The 'ollama-helpers' npm package versions 1.2.1 and 1.2.2 contains a postinstall script that automatically runs on 'npm install' and harvests a wide range of sensitive identity and configuration data from the host system. This includes OS hostname and username, git user emails, SSH public key comments, GitHub and cloud provider identities, AWS profiles, DNS domains, and CI provider information. The collected data is sent as JSON to a hardcoded anonymous Google Cloud Run endpoint unrelated to the legitimate Ollama project. The package falsely claims affiliation with the Ollama ecosystem via fabricated metadata and omits the declared main executable, indicating its sole purpose is data exfiltration. The scope of collected data far exceeds legitimate telemetry, and no consent mechanism is provided. According to the source, any system with this package installed should be treated as fully compromised, and all secrets and keys should be rotated from a clean system.

Installation of the affected 'ollama-helpers' package versions results in automatic execution of malicious code that exfiltrates sensitive host system information, including credentials and cloud account identifiers, to an attacker-controlled endpoint. This compromises the confidentiality of secrets and potentially enables further unauthorized access or lateral movement. The presence of this package indicates a full system compromise, and removal alone does not guarantee eradication of all malicious artifacts.

No official patch or fix is available. Immediate removal of the 'ollama-helpers' package versions 1.2.1 and 1.2.2 is recommended. Systems with this package installed should be considered fully compromised. All secrets, credentials, and keys stored on the affected system must be rotated from a separate, trusted environment. Monitor for any unauthorized access or suspicious activity resulting from this compromise. Exercise caution when installing npm packages and verify package authenticity.