If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (d4d5ebbbd036f50f2c29c885260a8b513897fcae3614f714585723f45ad492cd)
On require() of the package, index.js loads _compat.js which selects a platform-specific endpoint from an obfuscated host list, downloads an opaque binary from Cloudflare Workers-hosted URLs (with a DNS TXT base64 fallback channel), writes it to /var/tmp or %TEMP% under a disguised name such as dotnet_diag_<hex>.exe or.cache_<hex>, chmods it 0755, and spawns it detached via /bin/sh -c or cmd /c start /b. Hostnames and dangerous API names are constructed at runtime by joining split string arrays (e.g. reassembling 'oob-worker.cf...workers.dev' and require('child_'+'process'), fs['chmod'+'Sync']) to evade static analysis. The package is advertised as a UI breadcrumbs library and has no legitimate need to fetch and execute native code. A parallel dropper implementation is also shipped in lib/telemetry.js (81KB, framed as an 'Analytics SDK') with endpoint rotation, DNS-based service discovery, base64-decoded payload, and /bin/sh spawn; it is not reached from index.js in this version but is staged in the tarball.