The typst-resume-cli package versions 1.0.2 and 1.0.3 include code in index.js that loads https, http, and child_process modules and sends host and environment data to a hardcoded AWS Lambda URL controlled by an attacker. The code reads process.env and branches based on process.platform before issuing an HTTPS request to the malicious endpoint. The destination URL is unrelated to the legitimate Typst or resume tooling publisher, indicating intentional data exfiltration of credential-grade information from the installer's machine.

Sensitive environment variables and host attributes, which may include credentials or other confidential information, are exfiltrated to an attacker-controlled server. This compromises the confidentiality of the user's environment and may lead to further compromise if credentials are reused or contain elevated privileges.

No official patch or remediation is currently available. Users should avoid installing or using typst-resume-cli versions 1.0.2 and 1.0.3. Monitor for updates from the package maintainer or npm registry for any official fixes or removals of the malicious code.