If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (1bd6521302fb3f49a8c444435a33834be40a420972df3a03cadb5fdb3176a68f)
index.js line 75 decodes a base64-encoded string via Buffer.from(..., 'base64').toString('utf8') and passes the result to an evaluator, executing hidden code when the module is loaded. The obfuscated-and-exec'd blob pattern in a package presenting itself as a generic SDK is consistent with a supply-chain dropper: the actual behavior is concealed from casual inspection of the source and runs as a side effect of require()'ing the package. The package name suggests a blockchain/Layer-2 SDK, but the shipped code's only notable operation is decoding and executing an opaque payload.