The 'testzapier' npm package (versions 1.0.0 and 1.0.1) includes a preinstall hook that runs 'node index.js' during 'npm install'. This script spawns a shell that performs an HTTP POST request to a malicious external server, embedding the installer's username and hostname in the URL path. The User-Agent header contains a base64-encoded payload with the contents of sensitive files such as /etc/passwd, /etc/hosts, /etc/shadow (if readable), and the output of the 'id' command. This behavior leaks critical system information to an attacker-controlled domain unrelated to the package's intended functionality. The compromise is severe, as any system installing this package is considered fully compromised, with potential exposure of secrets and keys.

Installation of the 'testzapier' package results in immediate and unconditional leakage of sensitive system information to an attacker-controlled server. This includes user and host identity and contents of critical system files, potentially including password hashes if accessible. The compromise may allow attackers to gain full control over the affected system. Secrets and keys stored on the compromised machine should be considered exposed and rotated immediately. Removal of the package does not guarantee elimination of all malicious artifacts or backdoors.

No official patch or fix is available for this malicious package. The package should be removed immediately from any affected systems. All secrets, credentials, and keys stored on compromised machines must be rotated from a secure, unaffected environment. Consider the affected systems fully compromised and perform a thorough incident response and forensic analysis. Avoid installing untrusted or suspicious npm packages and verify package authenticity before installation.