If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (6f8126bab8131e5781af023537f7c5fc2456929c104f71312eeddcea358b5659)
Package ships no legitimate functionality: package.json declares main=index.js which is absent from the tarball, and the only shipped source is main.js, which runs from a postinstall hook (`node main.js`) during `npm install`. main.js collects host identifiers via require('os') — os.hostname(), os.userInfo(), os.platform(), os.arch(), process.cwd(), process.version — and POSTs them as JSON over https to the hardcoded collector URL https://webhook.site/13d98b4a-1999-4ec7-92c9-0697c259ca05. The declared purpose (SQL limit enforcer) is a cover; the artifact is an install-time reconnaissance beacon.