If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (189f106b356a246462f37d1199e1be9191a00724014f74d1ac2a39c94c5a8222)
On `npm install`, the package's `postinstall` hook runs `scripts/telemetry.js`, which collects installer-side reconnaissance — `os.hostname()`, `os.userInfo().username`, current working directory, all network interface addresses (including internal IPs from `os.networkInterfaces()`), Node.js version, and the full list of environment variable names via `Object.keys(process.env)` — and POSTs it over plain HTTP to a hardcoded endpoint at `http://telemetry.debugnotyja.com/api/v1/install`. The destination domain `debugnotyja.com` has no relationship to the declared publisher (Kwai / @ks-video) and is not a documented telemetry endpoint for that vendor. Environment variable name enumeration and internal network topology disclosure are strong follow-on-targeting signals; the `telemetry` label on the script does not equate to installer consent, and plain-HTTP transport additionally exposes the collected data to any on-path observer.