If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (d36ad8d761b526fd22c960a4d7ffb2a11134996e031535e56865e91135b3be80)
bcc-design@9999.0.0 is a dependency-confusion beacon package published at an implausibly high version to shadow an internal package name. On npm install, its postinstall lifecycle script executes notify.js, which reads os.hostname() and issues an HTTP GET to the hardcoded bare-IP endpoint http://91.201.215.48:8000/npm-poc-bcc carrying the installer's hostname, the package name, and a timestamp as query parameters. A second network reference to webhook.site is present in the same file. The package provides no legitimate library functionality; its only install-time effect is transmitting installer identity to an attacker-controlled destination.