The patientdocuments npm package version 75.0.0 includes a preinstall lifecycle script that runs a wget command to send sensitive environment information (username, working directory, hostname) to a malicious Cloudflare Workers endpoint over plain HTTP. This script also appears in the test and preupdate lifecycle scripts. The package contains no legitimate library code and is a dependency-confusion style malicious package designed for reconnaissance and identity exfiltration. The unsafe-perm flag is set, which can cause the script to execute with root privileges in privileged install contexts. According to the GHSA advisory, any system with this package installed should be considered fully compromised, requiring immediate secret and key rotation and removal of the package.

The malicious package leaks sensitive system information including the OS username, current working directory, and hostname to an attacker-controlled server. Because unsafe-perm is enabled, the malicious script can execute with root privileges in privileged install contexts, potentially allowing full system compromise. The presence of this package indicates a high likelihood that the system is compromised, and all secrets and keys stored on the system should be considered exposed and rotated immediately. Removing the package alone may not fully remediate the compromise.

There is no official patch or fix available for this malicious package. The recommended mitigation is to immediately remove the patientdocuments package version 75.0.0 from all affected systems. Treat any system with this package installed as fully compromised. Rotate all secrets, keys, and credentials from a separate, trusted system. Conduct a thorough security assessment to identify and remediate any additional malicious artifacts or persistence mechanisms that may have been installed. Monitor for any suspicious activity related to this package or its indicators.