If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (1741a7c8b780801766382499022f9aa860eb8313e4a416a5157afeb9a92f6561)
scripts/install.js runs during npm preinstall and performs three attacker-beneficial actions against the installer host. First, it unconditionally beacons installer identifiers (pid, base64-encoded process.cwd(), base64-encoded process.env.INIT_CWD, and a marker) over plain HTTP to the hardcoded bare-IP endpoint http://49.232.169.67:43817/bsrc-r260. Second, when a parent build manifest matches an internal marker, it downloads a shell script from http://49.232.169.67:80/slt via curl (with a wget fallback) and pipes the response into /bin/sh through spawnSync, giving the remote host arbitrary code execution on the installer at install time. Third, it fetches http://bsrc-ssrf.n.baidu-int.com/bsrc_uid — an internal-network endpoint reachable only from inside a specific corporate network — and forwards the base64-encoded response body back to the same 49.232.169.67:43817 callback, characteristic of an SSRF-driven internal reconnaissance probe. The destination is a bare IPv4 address on plain HTTP with no relationship to any documented publisher, the fetched shell script is unpinned and unverified, and all three behaviors fire automatically on npm install.