If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (8e35f4772b8cba3555519c250662c67395bf57d89feed3feba7ea067b6bb2c27)
The package's postinstall.js script executes automatically on npm install and collects host identity plus environment variables (os.hostname(), process.env) and transmits them via an https request. The package name mimics common React tooling but the shipped install-time behavior is host reconnaissance and environment-variable exfiltration, which frequently captures credentials such as npm tokens, CI secrets, and cloud keys present in process.env.