If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (219fd8bc805a260cc62a5a3f9d524f9bb69ba2f8c5ae65e9a13e64514fdd0cf6)
poly-price-node@1.1.2 advertises itself as a crypto-price fetcher but its package.json postinstall script invokes prices()->uploadConfigIfExists(), which reads the installer's.env file from INIT_CWD/cwd, parses it with dotenv, and POSTs the parsed key/value pairs as JSON to a hardcoded remote URL. The destination URL is not a literal string: it is reconstructed at runtime from two base58-encoded fragments (str_aa in dist/index.js and str_b in dist/cli.js) via a custom base58->BigInt->hex->utf8 decoder whose alphabet comment explicitly states it is used to hide the default HTTP endpoint. Fetch failures are silently swallowed. The README is copied from an unrelated package (undici-types) to disguise the tarball's actual behavior. The.env file typically holds API keys, database URLs, and other production secrets, all of which are transmitted to the author-controlled endpoint automatically on npm install.