If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: oracle-using-macaron (1f614e8ee6cce92be8b98394967c253336c0145808962bfda5032f085ece4eef)
This package executes arbitrary commands, steals sensitive data, exfiltrates credentials, and uses obfuscation techniques.