If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (c64040dcfbbdb6ce434caf3cd5bd2baa518cc00970281a69f5309d57a4621233)
package.json declares a postinstall lifecycle script that runs automatically on `npm install`. The script reads /tmp/flag.txt from the installer's machine and sends its URL-encoded contents as a query parameter to a hardcoded ngrok tunnel at https://ca37-49-237-83-218.ngrok-free.app/. The destination is an ephemeral tunnel host unrelated to any legitimate publisher, and the read+exfil fires without user interaction. The behavior matches install-time credential/file exfiltration with a concrete installer-side data source and a concrete attacker-controlled destination.