If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (f080fb3d5e59c5c950dd4dd0c2eb1841cdc2943e1543bd7803f7ca27d1756e60)
The package's package.json preinstall hook runs vishu.js, which at npm install time collects the installer's public IP (via api.ipify.org), OS hostname, and GitHub Actions / CI environment variables (CI, GITHUB_ACTIONS, GITHUB_WORKFLOW, GITHUB_RUN_ID, and related identifiers), then sends them as query parameters in an HTTPS GET to a hardcoded collector at https://webhook.site/66059630-2030-4b44-b2df-d37e02be0a7d. It also performs a DNS lookup encoding the hostname as a subdomain of an out-of-band collaborator domain (left as the placeholder your-collab-domain.oastify.com). Behavior fires automatically on npm install with no user interaction.