The npm package 'getd-web-corporativa' version 0.0.1 contains malicious code that exfiltrates sensitive installer environment data during installation. It sends hostname, OS username, platform, working directory, package details, CI/build indicators, and timestamps to a public webhook URL without user consent. The package has no legitimate functionality and is considered a malicious package. Installing this package can lead to full system compromise and requires immediate secret/key rotation and package removal.