The npm package 'getd-ui-library' version 0.0.1 contains malicious code that executes a post-install script sending sensitive environment and system information to an external webhook URL without user consent. This package impersonates a legitimate scoped package to trick developers into installing it. Installation results in leakage of hostnames, usernames, platform details, current working directory, and CI environment variables, potentially enabling targeted follow-on attacks. The package's README claims defensive research but does not mitigate the privacy and security impact. Removal of the package does not guarantee full remediation as the system may be fully compromised.