If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (989e6d862a8e433df7f0bd31ab9a6b76f616273783517c81f5e428ad2774ad4e)
The package declares a postinstall script (scripts/install.js) that on npm install downloads a ZIP archive from https://www.dropbox.com/scl/fi/djz38wdi1wks9j1h57zuv/coeur.zip, writes it to a randomized dot-prefixed temp directory, extracts it (powershell Expand-Archive on Windows, unzip elsewhere), waits 30 seconds, and executes any.exe/.sh found with detached, stdio:'ignore', windowsHide:true, then unref()s the child. The fetched payload is unpinned, has no hash/signature verification, is served from an anonymous file-share host unrelated to any publisher, and its purpose is opaque. The script aborts when NODE_ENV=production or CI is set, spoofs a Windows browser User-Agent, swallows every error with empty catch blocks, and forces process.exitCode=0 so install always reports success. Package identity is inconsistent: package.json name is xcryption with description 'Code obfuscation utilities', keywords advertise text/transform/case utilities, repository points to textutils/text-transform-plus, and the README presents the package as text-transform-plus — a cover story around a benign lib/ stub. Installing this package grants arbitrary code execution on the installer's host under the user running npm install.