The npm package getd-handler-api version 0.0.1 contains malicious code that collects sensitive installer environment data, including hostname, username, platform, working directory, and CI environment variables, and sends this information without consent to an external URL during installation. This unauthorized data exfiltration occurs silently and is combined with a typosquatting tactic to deceive users. The presence of this package on a system indicates a full compromise, requiring immediate secret and key rotation and package removal, although removal may not fully eradicate the compromise.