If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (82e7d0cd2ef4870fdc4484c815737ade78e04bdac4843df02f5cf876cfa3dbaa)
index.js decodes a base64-obfuscated IP (85.137.253.124) and connects a spawned /bin/sh subprocess's stdio to a TCP socket at 85.137.253.124:1111, granting remote shell access on the installer's host. package.json declares `postinstall: sudo node install.js`, and install.js uses node-linux's Service API to register a systemd unit named `CustomBot` that runs index.js with maxRestarts:10, providing root-level persistence of the backdoor across reboots. The C2 IP is stored as a base64 string and reconstructed at runtime to hide the destination.