If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (03bd3facc00c36861223058a572fbaa888d815a06c7b309c44639c544c65f1d9)
The package name suggests a Windows build helper utility, but no concrete behavioral evidence is available to confirm or refute installer-side risk. No exfiltration, install-time fetch, credential access, or other attack-class behavior was observed. The package warrants human review to confirm contents and intent before issuing a public verdict.