If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (008641dff89b7e4b86993671997e965642fab5620006c5ece0827f0fe72fe0d9)
On npm install, the preinstall hook executes index.js which collects host identity data (os.hostname(), os.userInfo().username, os.homedir(), current working directory, DNS server list) together with the full package.json contents and POSTs them to the hardcoded external endpoint https://eogo57c0daum9d3.m.pipedream.net. The behavior fires unconditionally at install time on every installer machine. A code comment references burpcollaborator/Interactsh-style beaconing, consistent with dependency-confusion reconnaissance: the beacon fires when a private internal package name is inadvertently resolved from the public npm registry, revealing the victim's internal infrastructure to whoever controls the pipedream endpoint. The exfiltrated fields identify the installer's host, user account, filesystem layout, network DNS configuration, and internal package/dependency graph.