If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (43ce408818d0222061c3b6ed499d77a245aae78e30e4f57c8e6e77ee52705805)
main.js in exiouss@5.0.1 imports child_process and issues POST requests to hardcoded endpoints, including https://gemini.google.com and https://ipc.shadxino.internal (main.js around lines 368-386). The presence of an `ipc.shadxino.internal` destination alongside a public Google host, combined with child_process usage and repeated `ping` invocations across the file (lines 202, 340, 420, 583, 611), fits an active-exfiltration/reconnaissance shape rather than any documented HTTP-client behavior. The `.internal` host is not a resolvable public destination and its appearance in a published npm module is consistent with an attacker-side collector or a leaked internal C2 name.