If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (657552d9de3cceb4fd25921aea0f1470d8c6f70af574242b4d3e4273367e2d30)
On require() of cardsmobile-cardsmobile-core, index.js loads _shim.js which selects a platform-specific payload path, fetches an unsigned executable from attacker-controlled Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS TXT chunked-base64 fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru, writes it to a hidden path under /var/tmp or %TEMP% with decoy names (dotnet_diag_*.exe,.cache_*), chmods 0755, and spawns it detached via /bin/sh or cmd.exe. A cooldown lockfile at /tmp/.analytics_state prevents re-runs. Endpoint hostnames and dangerous API names are assembled at runtime via.join('') from string fragments (e.g. require("child_" + "process"), fs["chmod" + "Sync"]) to evade static analysis, and lib/telemetry.js additionally decodes a base64 payload before executing it. A DISABLE_TELEMETRY environment check is present but does not gate the dropper. Loading this package grants remote code execution on the installer's host with detached persistence beyond the Node process.