If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (9c41d5d4352e265f0efbc0089a19c5773ceeb76c0265831eeeeca19151fe4f64)
package.json declares a postinstall lifecycle hook that runs `node -e` to issue an HTTPS GET to a hardcoded webhook.site collector URL, appending the installer's hostname (`os.hostname()`), OS username (`os.userInfo().username`), current working directory (`process.cwd()`), and a timestamp as query parameters. The request fires automatically on `npm install` with no opt-in and no relation to any documented package functionality. The version number (99.0.0) is consistent with a dependency-confusion lure intended to shadow an internal package name and beacon successful installs to the attacker.