If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: oracle-using-macaron (899ac6c3d1b62da3553aab693790598d0e87f6530b57d335deaee2545a39eb9c)
This package seems to be part of a larger malicious toolkit designed for unauthorized access to systems, data theft, and potentially acting as a placeholder for making calls across other malicious packages.