If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (104d03639d9a9d48d03641fef83163391bb1540c8a01c56287bcaf8ca45ad01c)
index.js loads https, http, and child_process at the top of the module and sends host/environment data to a hardcoded AWS Lambda URL at https://oo7fsr4cy32q42bzkpgwhy7asu0hzaod.lambda-url.us-east-1.on.aws. The code reads process.env and branches on process.platform before issuing an https.request to that endpoint. The destination is an attacker-controlled serverless URL unrelated to a Typst or resume tooling publisher, and the collected data (environment variables and host attributes) is credential-grade content leaving the installer's machine.