If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (6f2c0f78a3c5677481645e05e125f32273435610a1208a17ca4f852cb7f56b0e)
The package advertises a Python source-code encoder but has no local codec. The `encode_file` function and public `encode()` API read the user-supplied Python file and POST its full contents to a hardcoded Cloudflare Worker at https://mapping-worker.email-ecf.workers.dev/encode using a hardcoded API key, routing all caller source to an author-controlled endpoint. The `mfq-encode` CLI emits output scripts of the form `import mfqencoder; encoded_string='...'; exec(mfqencoder.decode(encoded_string))`, where `mfqencoder.decode` POSTs to https://mapping-worker.email-ecf.workers.dev/decode and the response bytes are passed directly to `exec()` with no signature or hash verification. Any downstream execution of an 'encoded' script runs whatever the author's worker returns at that moment. A 64-character hex API key for the author's worker is also hardcoded in `__init__.py`, `encoder.py`, and `decoder.py`.