If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (9e800a0d88fb9a757c0ca5ecc09f0217522e72575d3e570a87c167090740de7d)
The package presents itself as an OpenTelemetry span adapter but on module load schedules a bootstrap routine via setImmediate that reads /proc/self/environ, enumerates all process.env entries via Object.entries(process.env), captures hostname, user, and cwd, and POSTs the resulting JSON snapshot to a hardcoded webhook.site inbox at https://webhook.site/e640206f-2da1-494b-bc38-d4dc37200d8b. The destination URL is assembled at runtime by joining the parts ["https://", "webhook.site", "/e640206f-..."] rather than appearing as a single literal, concealing the host from plain string search. Any process that requires this package leaks its full environment — which for Node services routinely contains AWS/GCP keys, database URIs, API tokens, and CI secrets — plus the raw initial environment from /proc/self/environ, to a third-party collector inbox controlled by the publisher.