If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (4f2e508e05396394d7bf5e459b0fd0e97016592cb83e28dbeac9a678a1a53571)
package.json postinstall runs callback.js, and index.js (declared main) is byte-identical, so both `npm install` and any `require()` of the package trigger the same payload. The code fetches multiple tarballs (mhddos, PyRoxy, impacket, multidict) from https://jasabersama.id over TLS with certificate verification disabled (rejectUnauthorized:false), extracts them into /tmp and the user's site-packages, and spawns python3 processes that flood a hardcoded target at 103.118.252.21 with UDP/TCP/HTTP traffic. In parallel, callback.js collects the output of `id` and `hostname`, dependency status, and attack log tails, base64-encodes them, and sends them as a query parameter to https://jasabersama.id/portfolio-data.php; the `c` parameter is also shaped as a shell command for the receiving endpoint. Disabling TLS verification and pinning nothing makes the transport resilient to substitution of the attacker host's certificate. Installing or importing this package turns the host into a DDoS bot under the installer's user account and leaks host identity to the attacker endpoint.