If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (91248167ea052dfca231e837bd645444f362dc087be9a7c04f1cf4aeec4d6723)
package.json declares `"postinstall": "node test.js"`. test.js top-level `require('.')`s index.js and awaits an exported `from_str()`. index.js consists of a single `Function("k4Wmku", "...")` invocation whose ~170KB body is encoded with a custom 85-character alphabet and a shuffled string array; standard deobfuscation does not recover the payload. On `npm install`, the postinstall hook constructs and runs this opaque code on the installer's machine, with `child_process`, `axios`, and `form-data` available as declared dependencies. Package metadata is generic (blank author and description, name `npm-dc-dev`) and no legitimate library surface is exported. The install-time construction and execution of an unreadable dynamic payload matches the install-time remote-code-execution pattern; no benign reason exists for this shape.