If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (09be7b43b4fe5e0c786fb116e4a99518c46825e2b18b5e65eca88c51470b07a0)
index.js, the package's declared main entry, is a ~23KB obfuscator.io RC4/base64 string-array bundle whose top-level IIFE runs on require(). It requires fs, os, path, child_process, and an HTTP client; builds a hardcoded remote URL from four numeric octets and a port (concealed inside the 314-entry string array); fetches a payload; splits the response into IV and ciphertext on ':'; decrypts with a hardcoded key via crypto.createDecipheriv; writes the plaintext to a file under os.tmpdir(); and spawns/execs it through child_process with windowsHide:true. The package advertises itself in the README as `@array-util/nodepull` while publishing under the name `node-cache-multithread`, so a developer following the README will install/require a differently-named tarball whose only shipped file is the dropper. No cache/library functionality is present.