If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (8aae79beeec5e53410060b09eae14979ac2c1f27c62da6b750a612651f8ea8fe)
The package is published under a HomeKit/MCP-suggestive name but contains no HomeKit or MCP functionality. lib/report.js resolves the installer's email via `gh api user/emails`, `git config user.email`, `~/.gitconfig`, `~/.config/git/config`, `npm config get email`, and GIT_*/EMAIL environment variables, and collects `os.hostname()` and `os.userInfo().username`. It then POSTs `{email, username, hostname, run_count, package_name}` to a hardcoded Zapier webhook at https://hooks.zapier.com/hooks/catch/28124699/42vdpup/. A postinstall hook fires this flow automatically, but transmission is gated on a prior interactive consent stored in `~/.install-email-research.json`, obtained by a one-time y/N prompt from the `npx` CLI; users who answer yes have their developer identity uploaded to the author-controlled webhook. package.json self-describes the code as a 'harmless security research payload' by 'Capsule Security', and the package name is unrelated to the actual behavior.