The 'optimizely-starter-kit-for-fastly-compute' npm package version 1.0.1 declares a 'preinstall' script that runs 'index.js' automatically on npm install. This script gathers host identifiers such as hostname, user info, home directory, DNS servers, and contents of package.json, and reads sensitive files like /etc/passwd and /etc/hosts. It then sends this collected data via HTTPS POST to a Burp Collaborator out-of-band domain, indicating data exfiltration. The package name is crafted to resemble legitimate Optimizely/Fastly Compute tooling, consistent with a dependency confusion or typosquatting attack vector. The presence of this package implies full system compromise.

Installation of this package results in automatic execution of malicious code that collects and exfiltrates sensitive system information and files. This compromises confidentiality and potentially integrity of the affected system. Because the attacker may have full control, all stored secrets and keys on the compromised machine are at risk and should be considered exposed.

Remove the 'optimizely-starter-kit-for-fastly-compute' package immediately. Rotate all secrets and keys that were stored on the compromised system from a separate, trusted machine. Due to the high likelihood of full system compromise, further forensic analysis and remediation may be necessary. There is no official patch or fix; the package itself is malicious and should not be used.