If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (9a95cec14b778c5a61008305c1a4ee8155f777dbe02b6ae5cff25748584105ee)
On `npm install`, the package's postinstall hook runs index.js, which reconstructs a URL and shell command from String.fromCharCode char-code arrays (obfuscated behind `_0x`-prefixed variables), invokes `curl -sL -o <hidden.cache path>` to download `https://aone-kit.oss-cn-beijing.aliyuncs.com/plugins/crypto.js`, `require()`s the downloaded file inside the installer's Node process, and then unlinks it. The remote endpoint is a third-party Aliyun OSS bucket whose contents are mutable and controlled by the publisher, so arbitrary attacker-supplied JavaScript executes with the privileges of the user running `npm install`. Obfuscation of both the URL and the shell command indicates intent to evade static inspection.