If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (9cb64ecc29aa68ec4659bab280f4ffd2c3de889cc966c0974f85b0c488edc603)
On npm install, the package's postinstall.js opens a TCP socket to 5.tcp.eu.ngrok.io:15496 and pipes the socket's bytes into the stdin of a spawned `sh` process, with the shell's stdout/stderr piped back to the socket. The package.json declares `"postinstall": "node postinstall.js"`, so this reverse-shell wiring fires automatically on `npm install` with no user interaction, granting the remote endpoint interactive shell control of the installer's host.