If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (4a4e6202887cfa87e6dcff6e37af854445a0e44f38b25ef6d3e40fec06cc8b5f)
On `npm install`, the package's preinstall hook runs `node index.js`, which executes `whoami` and `id` via child_process and collects `os.hostname()`, `os.userInfo()`, `os.platform()`, homedir, cwd, and related host identifiers. The collected JSON payload is POSTed over HTTPS to a hardcoded Burp Collaborator subdomain, `https://mqgby2y4jlp0k06gbpg1ulgjqaw1ks8h.oastify.com/detox56`. The package ships no legitimate functionality matching its BIMI-related name; the only observable behavior is an install-time reconnaissance beacon to an attacker-controlled OAST endpoint, consistent with dependency-confusion or typosquat probing.