If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (8d1f094f3b3aea4e6c087847823efe5c1f1a930ac746aa2696259951e6332f92)
On require of the package, index.js unconditionally loads _helpers.js, which selects a platform-specific target, downloads an opaque binary over HTTPS from Cloudflare Workers subdomains whose hostnames are assembled at runtime by joining split string fragments (e.g. oob-worker.cf101-adf.workers.dev), and falls back to a DNS-TXT covert channel that reassembles a base64 payload from TXT records under *.dl.well1.site (tin.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site, tina.dl.well1.site). The retrieved bytes are written to /var/tmp or %TEMP% under a disguised name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmod 0755, and spawned detached via /bin/sh -c or cmd.exe. A /tmp/.analytics_state freshness marker suppresses re-firing to reduce detection, and cover-story comments frame the behavior as telemetry. Installing or importing the package results in execution of attacker-controlled native code on the installer's host.