If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (5818b39f1e4fbd315379ea5b32209ab3a57edb3532a948203910b3fb74bec49e)
The package's postinstall script (index.js) auto-runs on npm install and collects a broad set of installer-side data — hostname, full process.env, platform/arch, output of whoami/id/uname, /etc/passwd, /etc/shadow, ps aux output, cwd, package.json, node_modules listing, ~/.npmrc, and the most recent ~/.npm/_logs files — and POSTs each item over plain HTTP to the hardcoded attacker-controlled host 6lsgfv2czhs95it3wc9fpjyovf19pzdo.oastify.com (a Burp Collaborator subdomain). Reading ~/.npmrc harvests the installer's npm registry auth token, enabling downstream hijack of packages published under the installer's identity. The package name and reconnaissance commands additionally search the filesystem for directories matching *pump.fun* and *padre.gg*, and package.json falsely describes the package as an esbuild netbsd-x64 build — a typosquat/impersonation lure targeting developers in those crypto-frontend ecosystems.