If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (6ff9f45262c13bea579ed092cabfb043896d60c89787301b73eef78848802574)
package.json declares a postinstall script that runs beacon.js, and index.js also requires beacon.js on load. beacon.js POSTs the installer's os.hostname(), a persisted run marker read from os.tmpdir(), and stage info to a hardcoded webhook.site collector at https://webhook.site/b76376f8-118e-44f1-a5ee-8a73f55b137b, and additionally probes the cloud instance metadata service at 169.254.169.254 and metadata.google.internal with the Metadata-Flavor: Google header. The exfiltration fires automatically on npm install and again on import, with no consent gating and no caller-configurable destination. The package's self-description as a benign canary for authorized testing does not change the behavior: any environment that installs this package sends host identifiers and cloud-metadata reachability to a third-party webhook endpoint controlled by whoever holds that UUID.