If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (570031a196f05126b79c16e2910bc5c1c8c1534821e9b65231303b1bb5cd54e1)
package.json declares a preinstall hook that runs index.js on npm install. The script collects the machine's hostname, OS username, home directory, DNS server list, and current working directory, and reads /etc/passwd and /etc/hosts when present, then HTTPS POSTs the combined payload to a Burp Collaborator subdomain at mka6p95xmnkfcmdxv8cb4h2rpivej47t.oastify.com. Execution is automatic on install with no consumer interaction, and the destination is an out-of-band callback host unrelated to any legitimate tracker/detector functionality.