If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (081d3a8717b3f05f688cdde25d2b0de315dd9b1f400382e0db00d53f8ca82d6b)
package.json declares `preinstall: node index.js`, which runs automatically on `npm install`. index.js shells out via child_process and curl to POST the installer's `whoami`, `hostname`, and `id` output along with base64-encoded contents of `/etc/passwd`, `/etc/hosts`, and (if readable) `/etc/shadow` to a hardcoded out-of-band interactsh/OAST endpoint at `5f8a1ed70fb7761d678agw9bucryyyyyb.oast.site`. Package metadata shows an implausible version (99.0.0), placeholder description ("Nodejs SDK for Redacted"), and a nonexistent dependency, consistent with a dependency-confusion / typosquat beacon rather than a legitimate SDK.