If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (115345055f99da651c7816286c6b076dbacdd2b659f466dded1a541b289e8c2d)
bip32-js is a typosquat of the legitimate bip32 crypto library. Its index.js is an empty stub (module.exports = {}); the package's only functional code is a postinstall hook that runs automatically on npm install. The hook reads classic installer-owned secret paths —.env files, ~/.npmrc, ~/.aws/credentials, ~/.aws/config, ~/.ssh/id_rsa, id_ed25519, id_ecdsa, Solana ~/.config/solana/id.json, Ethereum keystores, and ~/.gitconfig — and additionally scans hidden home subdirectories for files matching wallet, seed, mnemonic, key, and keystore patterns. It packages the collected file contents together with os.hostname(), os.userInfo().username, and a timestamp, and POSTs the JSON body via https.request to the hardcoded endpoint https://enxhcjpo5ev.x.pipedream.net/c, an author-controlled Pipedream request-bin. The package.json also declares a suspicious dependency entry "self":"" alongside a wildcard pin on the real bip32 package.