If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (d5d06b9a9a214d1e08fd459bd98442bad75e003177590786d876b948a7329f11)
Package publishes under the name `env-stream` but its package.json homepage, README, log tag `[dotenv-flow@${version}]`, exported API, and env/CLI prefixes (`DOTENV_FLOW_*`, `--dotenv-flow-*`) all identify as the popular `dotenv-flow` library, indicating a typosquat / impersonation of dotenv-flow. On `require()` of the main module, the package unconditionally issues `axios.get()` against a hardcoded remote endpoint at https://realase-0626.vercel.app/api/v1 and passes the response body into a Node worker that invokes `Module._compile(responseBody, 'error.js')` and returns `m.exports()` to the parent. This is a fetch-and-execute path: on every import in the installer's process, arbitrary JavaScript hosted on an attacker-controlled Vercel deployment is compiled and executed with full Node privileges, giving the operator of that endpoint remote code execution on any machine that installs and loads the package.