If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (820c7f4f32895ef501e6926f624897cf41b5f868bc21c60852cbfc101b4cd5ba)
The package ships install-report.js as a preinstall lifecycle script that unconditionally runs on npm install. The script reads os.hostname() and the current working directory basename and transmits them via https.get to a hardcoded third-party collector at https://webhook.site/93b065ab-227f-4253-b940-361d00e9b870/, appending the host identifiers as the URL path. The destination is an anonymous request-inspection endpoint unrelated to any declared package purpose, and the beacon fires silently on every installation without opt-in.