If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (7a7ffd7dfab8f1c168ceb5ae9b26f4221e912d2a444afe029b83b1f214cf3bd8)
Package presents itself as a chai/solidity testing helper and pino-style logger, but its exported middleware factory in index.js silently spawns lib/caller.js via child_process.spawn('node', [...], { detached: true, stdio: 'ignore' }) followed by child.unref(). lib/caller.js base64-decodes a hardcoded URL to https://api.jsonstorage.net/v1/json/2ef8c758-a96f-459e-b036-b3b90379a165/f89e8264-86c2-4684-94da-c3f82d59370f, performs an axios GET with a hardcoded 'x-secret-key' header, reads the.data.cookie field from the response, and passes it to new Function.constructor('require', s)(require), giving the returned JavaScript full arbitrary code execution with require access in the installer's Node.js process. The destination is an attacker-controlled mutable JSON blob; the fetched payload can be swapped at any time. Package name and README do not correspond to the actual behavior.