If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (0ac486399ab6c99cf83bfcf80e487c414fd29430e27f0d929ff7034ed333c7e8)
The package's preinstall lifecycle script runs automatically on `npm install` and collects installer-side identifiers — `os.hostname()`, `os.userInfo().username`, the current working directory, and CI-related environment variable names — base64url-encodes them, and sends them to a hardcoded third-party out-of-band collector under `oob.lyomeri.com` via both a DNS lookup (`easypanel-deploy.<chunk>daco3v4q6f49egu1ds1gwjnsjb88s5kcp.oob.lyomeri.com`) and an HTTP GET request to the same host. The behavior fires without user consent on install, exfiltrates host reconnaissance data to an attacker-controlled endpoint, and is consistent with a dependency-confusion / beacon package. An in-source comment labeling this as a 'benign canary' does not change the observable behavior.