If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (fd7bf70af912ada62496485a2d5bdc063896ef3b4d6783cc459f3808ab151ddf)
Package name resembles the popular `react-bootstrap-table2-toolkit` with a `-bg` suffix and is published at version 9.9.9, a shape typically used to win dependency-confusion resolution against internal packages. On `npm install`, a lifecycle script executes beacon code that collects host identifiers via `os.hostname()`, `os.userInfo()`, `process.cwd()`, and `process.platform` and sends them as query parameters in a plain-HTTP GET to the hardcoded bare IP `http://100.24.177.136/cb`. The destination is not a package registry or publisher-matched endpoint, uses an IP literal rather than a domain, and transmits over cleartext HTTP. The manifest description self-labels the package as an authorized dependency-confusion proof-of-concept; such author-controlled labels do not change the behavior, which exfiltrates installer identity to an attacker-controlled endpoint on every install.
Source: ghsa-malware (cef5fac5058c556bc407491c506977e99b2bab4d2128b6bdd51d03169cbe89a0)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.