If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (468486d943cd98b0ff2388a965b8579bf5fb62ab9459802da8381551f9e1660f)
Package self-describes as a 'Compatibility shim' but ships no real functionality — its main module exports a Proxy returning no-ops for any property access. The actual payload is beacon.cjs, which runs both from a postinstall hook (`node beacon.cjs`) and on require of index.js, which calls fire() at top level. The beacon POSTs host metadata — os.hostname(), the install __dirname, process.cwd(), and a Node-version-tagged User-Agent — to the hardcoded bare-IP endpoint http://13.140.137.222:8787/_ah/dc over plain HTTP. Shape is consistent with a dependency-confusion or name-squat reconnaissance beacon: install-time callback is the entire purpose of the package, the destination is a bare IP rather than a vendor-identifiable host, and the no-op Proxy main exists only to avoid breaking any accidental resolution.
Source: ghsa-malware (3841b6d06a61a6dca4677771af04f3a1611aecea70dda90a4672bb4b6f1fc109)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.