If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (d897db063e1782ce6549adbac0736b75a2708f864c8eacfeaabac56b76c1bcbb)
Package presents itself as a date-formatting utility but ships a postinstall reverse shell. package.json declares scripts.postinstall = 'node postinstall.js'; postinstall.js hardcodes VPS = '8.135.48.40' and PORT = 4444 and runs execSync of a python3 -c payload that opens a socket to that host and invokes pty.spawn('/bin/bash'), with fallback branches using python3 subprocess and a Node net + child_process.spawn('/bin/bash') chain. Runs automatically during `npm install`, giving the remote host full interactive shell control on the installer's machine as the installing user. index.js implements a trivial date formatter as cover (a source comment translates to 'disguised as a normal date-formatting tool'); the library surface exists only to legitimize the package.