The npm package 'getd-transactional-web' version 0.0.1 contains malicious code that, upon installation, sends identifying system information to an unaffiliated third-party endpoint without user consent. This behavior is similar to a malicious typosquatting beacon and compromises the host machine. The package's README misleadingly presents it as a defensive measure, but the data exfiltration poses a critical security risk. Any system with this package installed should be considered fully compromised.