The typst-resume-cli npm package versions 1.0.2 and 1.0.3 contain malicious code that collects environment variables and host attributes from the user's machine and sends this sensitive data to an attacker-controlled AWS Lambda URL. This exfiltration occurs during the package's execution, potentially exposing credential-grade information. There is no known patch or fix currently available for this issue.