If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (2281890525d50138fab3030e71561f01f898fe9b97d56d2a894f1abf30632205)
The package declares a preinstall lifecycle hook (`node index.js`) that runs automatically on `npm install`. index.js collects host reconnaissance from the installer — os.hostname(), os.userInfo().username, home directory, DNS server list, and the contents of /etc/passwd and /etc/hosts, together with the package.json — assembles them into a JSON tracking payload, and POSTs the payload over HTTPS to the Burp Collaborator subdomain prk15yh0sbkd1305h200c2wv5mbhz7nw.oastify.com. The package name impersonates Cisco's GitHub namespace, consistent with a dependency-confusion recon beacon targeting internal Cisco builds. There is no legitimate purpose served by the code; installing or building against this package leaks sensitive host and account information to an attacker-controlled out-of-band domain.