If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (39614132e3675ec887b41aa6834ac54cce90e248d43f008345444b86e1870d82)
payload.js is declared as the package `main` and runs an IIFE immediately on require/import. It fetches a wordlist of Linux binary names from https://unpkg.com/@itsreduxtm/unpkg-xss-test@1.0.4/binlist.txt and issues concurrent HEAD requests to https://entretienextremejb.ca/bin/<name> for each entry, sourcing the traffic from the installer's machine and IP address. The package name (`unpkg-xss-test`) and GTFOBins-style wordlist shape indicate this is a browser XSS-delivered path-enumeration payload; when loaded in Node (fetch is global in Node 18+), the installer conducts the scan against a third party. This covertly weaponizes the installer's identity for reconnaissance against an unrelated site, exposing the installer to abuse reports, IP blocklisting, and potential legal complaints for unauthorized scanning.