If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (e8fd9342e97dc9f655a994fe1091125f717cbfa7b89aa6a2333662ad23ad6771)
The package runs an install lifecycle script (`node index.js`) and also executes `./lib/core.js` on require. That code collects `os.userInfo().username`, `os.hostname()`, and `process.cwd()` and issues a DNS `resolve4` for a label chain of the form `<pkg>.<user>.<host>.<cwd>.<ts>.oob.algamil7x.xyz`, exfiltrating installer identity and working-directory information over DNS to an attacker-controlled domain. The destination host and the `os`/`dns`/`process` module names are obfuscated in `lib/c5df9a.js` and `lib/b4ce8f.js` using char-code byte arrays (`String.fromCharCode`) and loaded via `module.constructor._load` instead of plain `require`, concealing both the APIs and the C2 destination. The obfuscation and DNS-label-encoded channel are inconsistent with the package's presentation as a shared web assets helper.