If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (9d987094f38a49c0bb9ae5329e3ff47d97489ee5af348ebc7e056e752cffc1fb)
On require(), index.js loads _runtime.js which detects OS and CPU architecture, reconstructs C2 hostnames from split string fragments (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev), and downloads a platform-specific executable over HTTPS. If those origins are unreachable, it falls back to a DNS-TXT-based delivery channel that reassembles a base64-encoded payload from numbered subdomains under *.dl.wel1.ru. The fetched binary is written to /tmp or %TEMP% under a disguised name (e.g. dotnet_diag_<rand>.exe or.cache_<rand>), chmodded 0755, and spawned detached via /bin/sh -c or cmd /c start. A TTL cache file (/tmp/.analytics_state) suppresses re-detonation on subsequent installs. The package name resembles a legitimate forms/cards library but ships no matching functionality; its only import-time effect is dropper execution.