If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (b7a0986932a47f49b162ea0438acfd0b6293e027e8ac2da46eb1221c5d52646c)
debug-proxy-chrome-devtools@1.0.1 declares a postinstall hook (`"postinstall": "node install.js"`) that automatically executes on `npm install`. install.js uses `child_process.execSync` to run `whoami` on the installer's machine and then issues an `https.get` to a hardcoded webhook.site collector (`https://webhook.site/cfe35ac2-bec3-48b8-bae1-a49dea5412c2`), passing the captured command output and hostname/command identifiers as URL query parameters. The package advertises itself as a Chrome DevTools debug proxy; that stated purpose has no need for shell reconnaissance or beaconing to a third-party request-inspection service. The combination of automatic install-time execution, capture of installer-side identity data, and a hardcoded non-first-party exfiltration endpoint matches the reconnaissance/beacon shape of a malicious postinstall payload.