If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: oracle-using-macaron (aed8328880d0c346cc1c0c9d51602617be4ea88a7a23878b68164484949555b2)
This package decodes a payload and executes it whenever it is imported. It seems to be targeting veilcord package users. Its contents are almost identical to veilcord, except for the addition of the malicious payload.