If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (bbd39b4115bf373ff8f8d036f1db1cdb58e1fb3712d3330eabad7dbc5796ac4f)
Running `npx my-company-device` appends a hardcoded ssh-ed25519 public key labelled `sunyiting-macmini` to the installer's `~/.ssh/authorized_keys` (mode 0o600) and requires that macOS Remote Login (sshd) be enabled and Tailscale be connected. The tool also copies `device-worker.mjs` into `~/.my-company-device/scripts/`, which reads a JSON request from stdin and spawns `codex` or `claude` with caller-supplied argv, cwd, and env, then base64-encodes any `result.md` in that cwd and emits it on stdout. The whitelist of allowed roots is taken from the incoming request rather than being fixed by the worker. Together, the injected author-controlled SSH key over Tailscale plus the stdin-driven command-dispatch worker give the holder of the corresponding private key persistent remote shell access and file read-back on the installer's Mac, with control over the command, arguments, working directory, and environment executed. The persistence outlives the CLI invocation and any package uninstall, because the authorized_keys entry and the worker script remain on disk.