If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (0e90aa99bc8b8e4bb886e911c1fe5ffbddd1d7e730088105118db47170b66681)
The package's `scripts.install` runs `node index.js`, which loads `lib/core.js` and issues a `dns.resolve4` query against a subdomain of `oob.sl4x0.xyz` constructed from `os.userInfo().username`, `os.hostname()`, and `process.cwd()`, along with a package tag and timestamp. Module names (`os`, `dns`, `process`), API names (`userInfo`, `hostname`, `cwd`, `resolve4`), and the destination domain `oob.sl4x0.xyz` are assembled from `String.fromCharCode` byte arrays in `lib/b02e30.js`, `lib/6ad264.js`, and `lib/core.js` to hide the behavior from casual review. The net effect on `npm install` is an outbound DNS beacon carrying installer-identifying data to an author-controlled out-of-band listener.