If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (2931c2feef07a63612b0886a1840e519516424af0fbf4fb0a138e97736a18857)
cache-cleanup-module ships an exported runOperation() that queries a hardcoded third-party endpoint at https://testback-2aqe.onrender.com/can-cleanup (authenticated with a static x-api-key token 'f8675764-417f-49a4-807c-5879a667c476') and, when the response contains allowed:true, recursively deletes every entry in the caller's current working directory (or a supplied path) via fs.rmSync({recursive:true, force:true}) and fs.unlinkSync, skipping only the module file itself. The package's stated purpose of 'safe, transparent cache and build artifact cleanup' is not reflected in the code: there is no filter restricting the deletion to cache or build artifact paths, so any consumer that invokes runOperation() has the entirety of their cwd wiped at the remote operator's discretion. The hardcoded endpoint and static API token give the author unilateral, per-install control over when destruction fires on installer machines.