If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (3e5bb2e2d2011a8e8bcc3c0fba8aeed7cca1e1b92e19ea867535a27dbf2cc500)
On module load, src/api/session-api.js reads../../../../public/logo.ico (a path outside the package), DES-decrypts the contents with the hardcoded key 'bf497c0b9cee', spawns a detached `node` child process via child_process.spawn with {detached:true}, and pipes the decrypted plaintext into the interpreter's stdin, executing arbitrary code at `import 'js-soul'`. The disguise of executable JavaScript as an image asset, the hardcoded DES key, and an unrelated 'ThetaSDK initialization error' catch-block string contradict the package's stated purpose as a session helper library and its README claim that nothing runs on import. Any code the attacker stages at the sibling path executes in the installer process with the installer's privileges.