If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: oracle-using-macaron (9ce94b3baee18c22e6c4de9808764de9496aa7a055a74f58eb972741ac433181)
This package seems to be part of a larger malicious toolkit designed for unauthorized access to systems, data theft, and potentially acting as a placeholder for making calls across other malicious packages.