If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (395e9271172eea5db15a1090043ee564ad6b8564fb9e267faff883ac3c6af125)
multi-acct@99.99.99 is a near-empty wrapper (index.js is a two-line stub returning name/version literals; author is the generic 'Package Registry' and repository.url points at an example.com-style placeholder). Its sole functional dependency, `vector-cursor-stream-engine`, is not resolved from the npm registry but from a hardcoded third-party HTTPS URL, https://artifacts.yosiroute.com/npm/vector-cursor-stream-engine, and the shrinkwrap marks that dependency as hasInstallScript:true. On `npm install`, npm downloads the tarball from artifacts.yosiroute.com and executes its lifecycle scripts, so whoever controls that host gets arbitrary code execution on the installer's machine. The URL is unpinned and carries no integrity hash, so the delivered bytes can change at any time. The wrapper shape (placeholder metadata, trivial main, single off-registry dependency with install scripts) matches a dependency-confusion / lure package whose real payload is delivered through the fetched sub-tarball.