If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (fe3cf14f1af4fe35fdc9c8635c3a4fa24e1d64610782d298d3e428446ce7f02c)
template-projection-map@22.1.1 is a functionally empty npm package whose only behavior is a reconnaissance beacon. The package.json postinstall hook executes beacon.cjs, which POSTs the installer's hostname (os.hostname()), install path (__dirname), current working directory (process.cwd()), and Node.js version to the hardcoded plain-HTTP bare-IP endpoint http://13.140.137.222:8787/_ah/dc. The same beacon is also fired from index.js at require() time via require('./beacon.cjs').fire(). index.js otherwise exports a Proxy whose every property returns a no-op, confirmed by the module's self-description as a Compatibility shim. The destination is a bare IPv4 address over cleartext HTTP, unrelated to any legitimate publisher infrastructure, and the package provides no advertised functionality that could justify such telemetry. The shape (install- and import-time outbound POST of host identifiers to an attacker-controlled endpoint on a stub/name-squat package) matches dependency-confusion reconnaissance tooling.
Source: ghsa-malware (39336416a695a52c21d74f7d971565610ee17c230d6af786821e4f69a240ff04)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.