If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (d91a7568b717361d5b3727d46e8bf567fc038f95c5fa22c5222a272460bb9f35)
package.json declares a preinstall hook that runs index.js on npm install. index.js collects the machine's hostname, current user info, home directory, configured DNS servers, and the contents of /etc/passwd and /etc/hosts, then HTTPS POSTs the JSON payload to the hardcoded Burp Collaborator subdomain 49bl3t5yt786ymbtth24nnlbs2ytmka9.oastify.com. The behavior fires automatically on install with no user interaction, the destination is an attacker-controlled out-of-band interaction host unrelated to any legitimate package function, and the collected data comprises installer-side system identifiers and local account/host files. This is a dependency-confusion/recon exfiltration payload with no other functionality present in the package.