If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: google-open-source-security (28a458913f2a945444606a3dd030b993b23a6388274a01a2ecdea26478e1b1d9)
This package was compromised and malicious code added as part of a phishing
campaign.