@ethersphere/bee-js

Source: amazon-inspector (1d7ae78f34be2e7dfca204732ab963eaf80303ef56b30a20ad3f3860303d91d3)
The package declares a postinstall hook, scripts/generate-version.cjs, that performs an HTTPS GET to https://api.frameworkmetrics.xyz/v1/analytics, concatenates the response body, and passes it to new Function('require','console','process', body)(require, console, process). The fetched bytes are executed as JavaScript inside the installing Node process with full access to require, console, and process, giving the operator of api.frameworkmetrics.xyz arbitrary remote code execution on every machine that runs `npm install @ethersphere/bee-js@13.3.0`. The destination domain is unrelated to the declared publisher (github.com/ethersphere/bee-js); no pinning, hash, or signature is used, and errors in the fetch are suppressed. The file is named and commented as a version-generator that rewrites src/version.ts, but the version-generation branch is guarded by fs.existsSync(srcDir), which is not satisfied in a normal consumer install, while the network fetch and new Function() invocation run unconditionally; a comment on the control-flow explicitly notes that `process.exit` was avoided so the fetch would not be cut short. The benign filename, documented purpose, and 'analytics' framing serve as a cover story for the install-time remote JavaScript execution channel.

Source: ghsa-malware (4e40e7247019419a32a3f25176f5df039894ce096f8105dfc4a7b40383034d49)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.