If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (d4c9e327ae7e806fc6d270807180963349c0b7578b69f31336780d87323fdafa)
Package `functions-framework-nodejs` is a typosquat of Google's `@google-cloud/functions-framework`. Its package.json declares `postinstall: node install.js`, and install.js runs `execSync("id")` on the installer's host, then POSTs the captured Unix user/group identity (with package name, version, and timestamp) to a hardcoded webhook.site collector URL. The advertised library surface (index.js) is a trivial stub exporting only name and version — the package's sole functional effect on install is the identity exfiltration. Package metadata self-labels as "For Security Research" by author "Berserk"; that label does not change the behavior: on `npm install`, installer-side host identity is sent to a third-party endpoint the installer did not configure.