If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (3b56d364976ed784e51324fe29d849cb6ac3495d32a5474e98eaf19ae7a308d0)
On require() of bigops-data-storage, index.js loads _compat.js which unconditionally runs a top-level routine that downloads a native executable from hardcoded Cloudflare Workers hosts (reconstructed via array-join, e.g. 'oob-worker.cf101-a'+'df.workers.de'+'v') with a DNS-TXT fallback to *.dl.wel1.ru (counted subdomains 'c.<domain>', '0.<domain>', '1.<domain>' concatenated and base64-decoded). The fetched bytes are written to /tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmod'd 0755, and executed detached via cp.spawn('/bin/sh',['-c', fp+' &'],{detached:true}).unref() or cmd.exe. Destination hostnames, the child_process import, and fs.chmodSync are assembled through string-splitting and property-name concatenation ('child_'+'process', 'chmod'+'Sync'), and payload filenames are disguised as 'dotnet_diag_*.exe' / '.analytics_state' with cover-story comments referencing telemetry and opt-out. A second, unreferenced dropper module lib/telemetry.js in the same tarball reimplements the same fetch-decode-chmod-spawn flow as an 'Analytics SDK'.