If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (7cfb99b5f4ad953f445a050a5cb70c26e477398cedef5406fdce1343887a6e38)
On require(), index.js loads _shim.js which downloads a platform-specific binary from anonymous *.workers.dev subdomains (hostnames assembled at runtime by joining split string fragments to evade static matching), writes the bytes to /tmp or %TEMP% under disguised names (".cache_<hex>" on Unix, "dotnet_diag_<hex>.exe" on Windows), chmods 0755, and spawns the binary detached via child_process.spawn("/bin/sh") or spawn("cmd"). If HTTPS retrieval fails, a DNS TXT fallback channel against *.dl.wel1.ru reads a chunk count from c.<domain>, iterates N subdomains to reassemble a base64-encoded payload, and executes the decoded bytes. No signature or hash verification is performed, the fetched content is opaque, and the routine is labeled "telemetry" as a cover story with a nominal opt-out. The behavior fires on any import of the package.