If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (ee650ff91eeb70cc76f880c6b66b586b21c471c95eac22a9e23160aaffa45a58)
The package is advertised as an SVG icon library but, on require, runs an IIFE that constructs an identifier from os.hostname() and process.env.USER/USERNAME and issues a DNS resolve against a subdomain of nxsqlpejfpamagxctjyv4c9qj1gfdtzwi.oast.fun — an interactsh-style out-of-band interaction collector. The hostname and username of the installing machine are leaked to a non-first-party DNS endpoint over outbound DNS, bypassing HTTP egress controls. The same import-time code enumerates process.env keys matching /token|secret|key|pass|aws|github|npm/i and prints the matching names alongside hostname, user, cwd, and Node version. No icon-library functionality justifies DNS beaconing or credential-name enumeration, and the host identity is sent to a destination the caller did not configure.