If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (3b599c4cb22f02d79a217a53a61243a08017783b2a8d41afaa59b46128d863c2)
Package declares scripts.install="node index.js", which top-level requires lib/core.js. lib/core.js reads os.userInfo().username, os.hostname(), and process.cwd(), joins them with a package tag and timestamp, and issues dns.resolve4() against a subdomain of oob.sl4x0.xyz — a DNS-tunneled beacon to an attacker-controlled out-of-band collector. The destination host oob.sl4x0.xyz and the Node API names (os, dns, userInfo, hostname, cwd, resolve4) are stored as hex byte arrays in lib/b02e30.js and lib/6ad264.js and reconstructed at runtime via String.fromCharCode to disguise the recon path. The beacon fires automatically on npm install and again on every require() of the package, with no user interaction required.