If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (188c65369497c00333fc54291c970071044f3237a255387903a707cfd2711599)
On import, index.js reads os.hostname() and issues an HTTPS GET to `ixel.<hostname>.200majoeu01dk02xnjdajro1isojc90y.oastify.com/ixel` (oastify.com is Burp Suite's Collaborator out-of-band interaction domain). The hostname is embedded as a DNS subdomain label, so the DNS resolution alone leaks the installer's hostname to an attacker-controlled nameserver regardless of whether the HTTP request succeeds. Any developer machine or CI runner that `require()`s this package — directly or transitively — sends a host identifier to the operator of the configured Collaborator instance. The package.json description ("Security PoC placeholder - benign, no runtime payload") contradicts the shipped code, and the `@onum-releases` scope appears designed to resemble a legitimate vendor releases namespace.