If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (525ae6b33885c1153dac485b830c8977b433ba4cdd2cc9556415b146ed801569)
No malicious behavior was identified in this package version. No lifecycle scripts performing remote fetches, no credential reads, no exfiltration endpoints, and no suspicious code patterns were observed. With only two files in the package and no concerning content, there is no evidence of installer-side harm.