If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (b71ef624b0206201b243cfed88cdfc36804bbfd903f60cb7c9da9cfa64b4b2a7)
On require of the package, index.js loads _helpers.js, which selects a platform-specific endpoint from a list of Cloudflare Workers hosts assembled by joining string fragments (oob-worker.cf10-3-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS TXT chunked-base64 fallback under *.dl.well1.site whose domain labels are also reconstructed from split arrays. The fetched binary is written to /var/tmp or %TEMP% under a disguised name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmod 0o755'd, and spawned detached via spawn("/bin/sh", ["-c", <path>+" &"], {detached:true}).unref() or the cmd equivalent. There is no hash or signature verification of the downloaded bytes, the endpoints are attacker-controlled Cloudflare Workers hosts unrelated to any declared publisher, and the package's stated purpose ("accounts constants wrapper") does not involve any native binary. Additional anti-analysis behavior includes a fake env-var opt-out (DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK), an mtime staleness marker gating re-execution, and stderr silencing.