If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: oracle-using-macaron (da5627aaacdf2bd8ab0ce2e469ea8635108e857776ed8766ee9df47c4b66aaa8)
This package appears to be part of a larger ecosystem acting as a placeholder for orchestrating interactions with other bsb malicious packages.