If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (23ee684fa7edabc6e34aedc6e32e36c42fb68100a69908227e639d53592565de)
lychee-norm-cache is a dependency-confusion proof-of-concept that provides no functional utility. Its bin script POSTs a small JSON payload containing the package name, a timestamp, and the basename of INIT_CWD (the directory in which npm/npx was invoked) to a hardcoded callback URL at https://deepbounty.dd06-dev.fr/cb/<id>. The package has no install lifecycle scripts and the declared main entry is absent, so the beacon fires only when the bin is explicitly executed (typically via npx, or when this name resolves in place of an intended internal package). The data sent is minimal and non-credential (project directory name only); there is no exfiltration of environment variables, files, or secrets, no remote code execution, and no persistence. However, the package occupies a namespace that may collide with internal package names and silently emits installer-side context to a third-party host without consent.
Source: ghsa-malware (b7ad5acb0beb469a4f953cb1e1adab206bf03ad18d45c11b5cb895b1aff79114)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.