The @woodpecker-web-shared/components npm package includes a postinstall hook that runs 'node index.js' upon installation. This script collects host identifiers such as hostname, username, platform, architecture, current working directory, Node.js version, and npm lifecycle event, then sends this data as JSON to a hardcoded external webhook URL. The payload includes a campaign identifier 'src: loMesb' used to correlate data across victims. This behavior is unauthorized and indicative of a malicious reconnaissance beacon, likely part of a dependency confusion or typosquatting attack. According to the ghsa-malware source, any system with this package installed should be considered fully compromised, necessitating immediate secret rotation and package removal, though removal may not fully eradicate the compromise.

Systems that install this package are subject to unauthorized data exfiltration of host identifiers to an attacker-controlled endpoint. The presence of this package implies potential full system compromise, risking exposure of all stored secrets and keys. Attackers may have persistent control beyond the package itself, making remediation difficult.

No official patch or fix is indicated. Immediate removal of the @woodpecker-web-shared/components package is recommended. All secrets and keys on affected systems should be rotated from a separate, uncompromised device. Due to potential full system compromise, further forensic analysis and remediation may be necessary. Monitor for and avoid installing packages from untrusted or suspicious sources, especially those with unexpected network communications during installation.