If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: oracle-using-macaron (83b5a97c937ac16481e2ad27346069180a0a823c5f6b361cc4e7f08e97716c24)
This package decompresses and executes a base64-encoded malicious payload.