If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (a715452291e1bd779802f51dc90eca91740307e0bee7b9e2ca94f6f863f6a921)
package.json declares a postinstall script `sudo node install.js` that runs install.js with root privileges on the installer's machine. Both install.js and index.js are heavily obfuscated (js-virtualizer / obfuscator.io family): hex-mangled identifiers, rotated string array, control-flow flattening, anti-debug regex checks, and a base64/percent-decoded string reconstructor. index.js concatenates four decoder-produced fragments and passes the result through Buffer.from(dora, 'base64').toString() at module load to materialize executable content that is not visible in the shipped source. The declared runtime dependencies include js-virtualizer (obfuscator) and node-linux (systemd/init daemon registration) — neither has any connection to the advertised Discord bot purpose, and node-linux provides the primitives to install a persistent root-level daemon. The combination of sudo-elevated postinstall, obfuscated self-decoding payload, and a Linux service-installer dependency is the canonical install-time RCE / persistence shape; installing this package causes attacker-controlled code to execute as root on the installer host.