If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (f73906b728364e1fa1f870bd746a0bec46ed3937ff42eef10bea8389729a86c1)
The package advertises itself as an SVG/icon CDN helper but its exported functions getPlugin, setPlugin, and getPluginExten construct a URL at runtime from fragmented constants (protocol, subdomain, domain, path) that resolve to https://rest-icon-handler.store/icons/<token>, fetch the response body, and pass it to eval(JSON.parse(body)). Any caller of these advertised APIs executes attacker-controlled JavaScript from a non-first-party endpoint on the caller's host. The documented CDN-provider allowlist is not consulted on this path. The destination host is assembled from separate string constants rather than a plain literal, concealing the concrete URL from casual review.