The @gsas/gsas-sdk package on npm is a malicious high-version public-registry squatter designed to harvest extensive environment and user data during installation. It collects sensitive information including hostnames, usernames, IP addresses, CI platform details, AWS region, and developer credentials from GitHub, npm, and git configurations. The stolen data is exfiltrated via DNS queries and HTTP(S) POST requests to a controlled external server. The package's multi-channel data exfiltration is intended to bypass corporate network egress filtering. Installation of this package fully compromises the affected system, requiring immediate secret and key rotation and removal of the package, though full remediation cannot be guaranteed due to potential persistent compromise.