If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (49b66b93df02350bdf848ac2cff8c6a563ac36c1828480891381875453be67f5)
The package's postinstall.js runs automatically on npm install and collects host reconnaissance data — os.hostname(), os.userInfo() username, process.cwd(), and the list of environment variable names from process.env — then POSTs the JSON payload via https.request to a hardcoded webhook.site capture URL (webhook.site/4b333dc6-9783-4f6b-82fa-db9795caa938). Environment variable values are masked but key names and host identifiers still leave the installer's machine on every install. The package's index.js contains only a trivial 5-line Vue button component, which does not correspond to the install-time beaconing behavior; the shape is consistent with a scoped dependency-confusion or reconnaissance probe measuring which internal build hosts resolve the @catamania scope to the public registry.