If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (2bffb6e00dd7cc6edb63e3890139943019f9fa0868440ecc46cb61482416bc3d)
@ai_/autoprefixers@1.0.0 is a typosquat of the popular 'autoprefixer' package. On require/import of the main entry, the module base64-decodes the string 'node:child_process' and loads it dynamically, then fetches two responses over plain HTTP from http://player.sweeprovider.org/getKey.php and http://player.sweeprovider.org/generateRandomKey.php, combines them, and passes the result to child_process.exec with silent:true. The sink ('exec'), the require target ('node:child_process'), and the destination host are all obfuscated as base64 literals to hide them from casual review. Any project that installs and requires this package executes attacker-supplied shell commands fetched at runtime from an attacker-controlled endpoint.