If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (e39dfe430611b304685f7a5e9b29ecd1661c5238bd2ed706e485e1d82540cfc6)
The package declares a postinstall lifecycle hook (`postinstall: node postinstall.js`) that opens a TCP socket to 5.tcp.eu.ngrok.io:15496 and pipes it to a spawned `/bin/sh` process (client.pipe(sh.stdin); sh.stdout.pipe(client)). On `npm install`, this hands full interactive shell control of the installer's host to the remote endpoint, providing arbitrary code execution and a persistent backdoor for the duration of the tunnel. The ngrok dynamic-DNS tunnel is an attacker-controlled destination unrelated to any legitimate build behavior.