If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (6b82e18fdadfd37a1622c522a7ca4e9ae7772b266175123dfabb8d90e3950ef6)
On require of @mgor/fw-canary-3333, index.js executes a top-level shell command that curls https://fewafw.hydege.me and pipes the response into /bin/bash, running attacker-controlled shell content on the installer's host. The fetch is unpinned, unverified, and directed at a non-registry, non-publisher domain, so the executed bytes are whatever the remote host serves at request time. The package.json and README present the package as an inert canary with 'no functionality, no dependencies, and no install scripts', a cover story that directly contradicts the fetch-and-exec side effect in index.js.