If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (7eb103b6863369372ba8c07701264f8b0f6b57e3217e07912c8efbd9371c648f)
The package's preinstall lifecycle script (preinstall.js) executes automatically on `npm install` and collects the installer's hostname, OS username, current working directory, and CI-related environment variable names. The collected data is base64-encoded and transmitted to a hardcoded out-of-band collector under lyomeri.com via both a DNS lookup (encoding data into a subdomain label under easypanel-agent.<data>.oob.lyomeri.com) and an HTTP GET request to the same host. The package's main entry, index.js, is an empty stub (`module.exports = {}`), so the install-time beacon is the sole functional behavior. The package name mimics the 'easypanel' product, consistent with a dependency-confusion or typosquat delivery vehicle. An in-source comment self-labeling the code as a 'benign canary' does not change that installer-controlled data leaves the machine without consent to an author-controlled endpoint.