If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (4135dd91724bdca6fc36f3a49906d219acc67afde7802cb1bd114d128984ca3d)
The package's postinstall hook runs `node./loader.js`, which base64-decodes an ~8 KB embedded blob, XOR-decrypts it with a hardcoded 32-byte key, and pipes the resulting bytes into a detached, window-hidden `python -c -` child process via stdin. The loader also silently `pip install`s `requests` if missing. The advertised library surface in `index.js` is an explicit stub whose `connect()` throws, and `package.json` restricts installation to `os: ["win32"]`, so the tarball has no functional wallet-adapter behavior — its only effect on install is to execute the obfuscated Python payload on a Windows developer's machine. The combination of a hidden opaque payload, XOR-obfuscated delivery, detached hidden Python execution at `npm install` time, an inert cover-story main module, and OS pinning to Windows is a targeted install-time dropper.