If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (a0701359abf624183b03e0c8f4ca925a7b494923a581f943fa2f97f26d506b2e)
On require() of bigops-header-tabs, index.js loads _adapter.js which selects a platform-specific remote path and fetches an opaque binary from obfuscated Cloudflare Workers hosts (hostnames reconstructed by string-join, e.g. "oob-worker.cf10"+"2-baf.workers.dev"), with a DNS-TXT-record-based staged retrieval fallback via subdomains of dl.wel1.ru (c.<domain> for chunk count, i.<domain> for base64 chunks). The fetched payload is written to /tmp or %TEMP% under masquerading names (dotnet_diag_,.cache_, analytics_state), chmod 0755 on Unix, and spawned detached via /bin/sh -c or cmd.exe. Execution is gated by env-var opt-outs and a stamp file to run once per host. The package README advertises only a trivial "header tabs" SDK, which does not require any native binary or child-process execution. Fingerprints present: hardcoded/reconstructed attacker C2 bound to install-time-reachable network+exec, obfuscated destination hostnames, DNS covert channel, filename masquerade, purpose mismatch between advertised functionality and shipped behavior.