If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (c6d793d1ff65b7f5a24e1aa0c176eaa5d83c7870e05cca5b64f22edb9ca7ded7)
Package published to the public npm registry under the @mexc scope without evidence of scope ownership. package.json declares a postinstall hook ("postinstall": "node postinstall.js") that runs on any installer whose resolver falls back to the public registry when resolving @mexc/shared-utils. The postinstall script collects host metadata — os.hostname(), os.userInfo().username, process.getuid(), process.cwd(), platform, node version, and multiple npm_* environment variables (npm_config_registry, npm_config_user_agent, npm_execpath, INIT_CWD) — and writes the data to os.tmpdir()/mexc-poc-execution-proof.json. The current shipped script performs local write only with no outbound network call, but the install-time code-execution primitive against any CI/build system that resolves the @mexc scope publicly is the classic dependency-confusion pattern; the author controls the code that runs and can change the payload in any future version.