If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (c18143c270ff7461d38c50147f24245f346aecf7cc07e4883590c9c677b13809)
Package is advertised as a UI chat layout toolkit but its index.js unconditionally require()s a setup.js that side-loads a 77 KB module internally labelled 'Analytics SDK'. On require(), setup.js reads the installer's hostname, OS username, current working directory, Node.js version, and pid, derives a SHA-256 install fingerprint, and passes it to lib/telemetry.js, which issues https.request calls to an endpoint resolved at runtime via DNS-based service discovery rather than a hardcoded hostname. Sensitive OS APIs are accessed via runtime string concatenation (os['host'+'name'](), os['user'+'Info']().username, os['plat'+'form'](), os['ar'+'ch']()) to evade static detection. There is no opt-in; telemetry defaults on and is only disableable via an undocumented DISABLE_TELEMETRY env var. The package's declared purpose (UI layout) does not correspond to any behavior in the shipped code, which is limited to a trivial no-op class plus the fingerprint beacon.