If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (1b0faa243ad4d8a3f6d3b76b94da84738fcd5a097efc0c2e920b4f029b76f970)
setup.js runs at install time: it performs an HTTPS reconnaissance request (https.get to a remote host with an identifier payload) and then spawns a platform-specific shell (spawn("/bin/sh") on POSIX, spawn("cmd") on Windows) via child_process. The file is invoked as an npm lifecycle script, giving the remote-directed shell execution on installer machines with no user interaction beyond `npm install`. The combination of an install-time outbound HTTP callout plus unconditional shell spawn is a dropper/backdoor shape rather than any documented build behavior, and the package name (a lookalike of common dependency-related utilities) has no legitimate purpose requiring shell execution during install.