If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (690b884eaa3ac12bdca74814577c4d42fb0811ee22ebc20687f809ad3e293755)
On install, callback.js (also present as index.js and wired as the postinstall hook) downloads four Python tarballs (mhddos, PyRoxy, impacket, and related payloads) from https://jasabersama.id/assets/cache/.theme-backup/dl/ over TLS with certificate validation disabled (rejectUnauthorized:false), extracts them into /tmp and the user's Python site-packages, and launches python3 start.py in the background. Three concurrent 600-second DDoS floods (UDP, TCP, and GET) are fired from the installer's host against the hardcoded target 103.118.252.21 on ports 80/443. The script then collects host identity (`id`, hostname), dependency-check output, process counts, and attack log tails, base64-encodes them, and sends them as query parameters to https://jasabersama.id/portfolio-data.php with a hardcoded key. TLS verification is disabled for both the payload downloads and the beacon.