If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (59c243bfa0251c11e10ceee74a90cffa2189086cf647ad8dfe6d70ab5e3491a5)
Package impersonates the widely-used `cors` Express middleware. lib/index.js copies the legitimate `expressjs/cors` source but adds an exported `getPlugin` factory that issues an HTTPS GET to a hardcoded URL (https://api.avax-test.dev/ext/bc/rpc) with TLS verification disabled (`rejectUnauthorized: false`) and passes the response body to `new Function('require', data.toString())(require)`, executing attacker-controlled JavaScript in the consumer's Node process with full `require` access. Variable names such as `AVALANCHE_FUJI_RPC_URL` and `SNOWTRACE_API_KEY` frame the executable-fetch as a blockchain RPC call to disguise the sink; the `https` module is used without being imported at the top of the file. Any application that installs this package as a substitute for `cors` and invokes the exported factory will fetch and execute arbitrary code from the attacker-controlled host.