If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (34c221d8f8f0fedded27bfc22763912ffd96e9f3d1b2c08932e054ed418f493e)
The package ships thunderboltRegistry.js, a module that imports Node's child_process primitives and executes `whoami` plus repeated `ping` commands against external hostnames, with POST calls present in the same file. The pattern (whoami capture + repeated ping-based beacons + outbound POSTs) is host-reconnaissance and DNS/ICMP-channel exfiltration shape, directed from the installer's machine to an external endpoint. The behavior is unrelated to the package's advertised purpose (a trivial viewport-unit calculator) and provides no functionality to a consumer; its only effect is to leak host identity information off-host when the module is loaded or invoked.