The 'paypal-postman-lib' npm package imports system modules to read the host's hostname and user information, then transmits this data via HTTPS to a domain linked to malicious activity. The package masquerades as a legitimate PayPal/Postman library but only performs data exfiltration. Installation or execution of this package results in the compromise of host identity information, potentially enabling further malicious actions. The package versions 1.0.1 and 2.0.9 (including >=2.0.9) are affected. Removal of the package alone may not fully remediate the compromise, as the attacker may have gained broader control over the system.

Systems with this package installed or running should be considered fully compromised. Sensitive information such as hostnames and OS user identities are exfiltrated to a malicious third party. This exposure can lead to further unauthorized access or exploitation. All secrets and keys on the affected system should be rotated immediately from a separate, trusted machine. Simply removing the package does not guarantee elimination of all malicious software or backdoors introduced by the attacker.

Remove the 'paypal-postman-lib' package immediately from all affected systems. Rotate all secrets, credentials, and keys that were stored on the compromised machine from a different, secure device. Because the package may have allowed full system compromise, consider rebuilding or thoroughly auditing the affected systems to ensure no persistent backdoors remain. There is no official patch or fix available; remediation relies on removal and incident response.