If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (8c4077e84d7c02b7a8259ade848e89f9fd07ba0db7fb06bbaaa0c6e75f3e007d)
On `npm install`, preinstall.js enumerates process.env for keys matching credential substrings (KEY, SECRET, TOKEN, PASSWORD, AWS, API, CREDENTIAL, AUTH, PRIVATE, NPM, GIT, GITHUB, GITLAB), reads the working directory's.env and package.json, runs `git remote -v`, and POSTs the collected data via https to a hardcoded webhook.site collector (https://webhook.site/34e76ae9-12e2-4fea-a33a-24f4e1ac5eb2). A companion postinstall.js labeled internally as 'backup exfil' POSTs os.hostname(), os.userInfo().username, and process.cwd() to the same endpoint. Both lifecycle hooks fire automatically on default install, with no relationship to any advertised package functionality.