The upload-to-gcp npm package version 3.2.1 runs a postinstall lifecycle script that collects host identifiers such as os.hostname(), process.platform, process.arch, Node.js version, package name, and npm lifecycle event. It then sends this information via an HTTP POST request to a hardcoded, non-GCP domain (https://z5owtt3g.instances.poc.jchunt.top/upload-to-gcp). The domain appears random and unrelated to any legitimate Google Cloud service, suggesting the package is performing unauthorized data exfiltration under the guise of a GCP utility.

This malicious behavior results in unauthorized collection and transmission of system and environment information to an attacker-controlled server. This can lead to privacy violations and potentially aid further targeted attacks or reconnaissance. There is no indication of direct code execution beyond the postinstall script or broader system compromise from the provided data.

No official patch or remediation is currently documented. Users should avoid installing upload-to-gcp version 3.2.1. Review and remove this package if present. Monitor for updates or advisories from the package maintainers or npm registry. Since this is a malicious package, consider using trusted package sources and verifying package integrity before installation.