If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (86c68c82f6ead4ab3b823b81fd6805991bfdd65cdc901d83aeb561cdd8f27b19)
package.json declares `"libsignal": "github:tenka-san/libsignal-node"` — an off-registry dependency source pointing at a personal-user GitHub repository with no commit SHA, no tag, and no integrity check. On `npm install`, npm clones the current tip of that repository and installs whatever it contains, running any lifecycle scripts (`preinstall`/`install`/`postinstall`/`prepare`) inside the fetched tree on the installer's machine. The dependency key `libsignal` shadows the well-known Signal protocol library, but the source is a personal user's fork rather than the upstream signalapp organization, so whoever controls the tenka-san/libsignal-node repository controls install-time code execution on every installer of this package. The source is mutable — content that resolves benign today can be replaced without any change to this package. A secondary observation: lib/Utils/generics.js line 403 references `ping`, but this is unrelated to the primary install-time execution concern.