If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (91c0275a4e65fc4ed9930cb89002f2c4ebc50163b292f552703c4ea6a9940567)
package.json declares postinstall: `node index.js`, which fires automatically on `npm install`. index.js is a heavily obfuscated bundle (obfuscator.io-style RC4-decoded 344-entry string array with control-flow flattening) whose runtime behavior assembles a destination host at runtime by concatenating four numeric fragments with '.' (an IPv4 built to hide the C2 from static review), performs an HTTPS request to that host, splits the response on ':' into IV and ciphertext, derives a key via pbkdf2, AES-decrypts the response with createDecipheriv, writes the plaintext payload to disk via fs.writeFileSync, and executes it through child_process.exec with `windowsHide:true` to suppress a console window. The package name resembles `express` middleware but ships no middleware functionality; the sole effect of installing it is remote code execution on the installer's machine under attacker control.