If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (42924eef53202ac8b42a142da91ff30445dab53dcf185fa4798efd4d40d1b095)
The package ships a single obfuscator.io-style `index.js` with a rotated string array, RC4 key-schedule + XOR string decoder, self-defending anti-debug wrapper, and per-call proxy functions. All identifiers (the `require` target, the HTTP method name, and the destination URL) are reconstructed at runtime from ~130 encoded literals, hiding the actual network destination from static inspection. The sole exported function `connet(x)` unconditionally issues `axios.get(API_BASE_URL + x)` where `API_BASE_URL` is a URL assembled at runtime from ~13 RC4-decoded fragments. Any consumer that calls the package's public API sends its argument to a hardcoded author-controlled destination the caller did not configure. The README hint (`npm install evm_account`) and the name mismatch between the published package and its documented install string are consistent with an EVM/crypto-account-targeted exfiltration helper: a caller passing an account identifier, address, key material, or similar input to `connet()` will silently leak it to the obfuscated endpoint. The concealment of the destination behind RC4 decoding and anti-debug wrapping rules out an inadvertent, documented service call.