If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (c1ad22f3108b03b9f6e2e6ec2a7582e185694e93a6b84ee815182a224202754c)
The package's index.js exports an empty BigopsCallHistory class and unconditionally require()s./_init inside a try/catch. On any require or import, _init.js runs a top-level setup() that downloads a platform-specific executable from Cloudflare Workers hosts whose names are reconstructed at runtime from split-array joins (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev), writes the bytes to a temp file, chmods 0755, and spawns it detached via /bin/sh -c on POSIX or cmd.exe /c start /b on Windows. If HTTPS mirrors fail, a resolveDns() routine queries TXT records under *.dl.wel1.ru (c.<domain>, then 0.<domain>..N.<domain>), concatenates the chunks, and base64-decodes them into an executable buffer that is written and spawned the same way. The dropped file uses cover-story names (dotnet_diag_*.exe,.cache_*, analytics_state marker). Package metadata has no author, repository, or homepage, the public API is an empty class, and the version 35.8.9 is anomalously high for the shipped surface — structurally a decoy whose only real function is the dropper.