If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (e561191e4649855e72a45b41f9fe45375ee5558a851e0c029dce070aa23d5608)
On require('cardsmobile-rs-api'), index.js loads _support.js, which reconstructs remote hosts via string-array join (oob-worker.cf103-070.workers.dev, cf102-baf.workers.dev, cf99-9b3.workers.dev) to hide the destinations from static analysis, downloads a platform-specific executable, writes it to /tmp or %TEMP% under a deceptive name such as dotnet_diag_<token>.exe, chmods it 0755, and detached-spawns it via child_process.spawn('/bin/sh') or spawn('cmd'). A DNS TXT-record fallback channel over sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru serves as an alternate transport. A TTL marker file (.analytics_state) gates the drop to fire once. The package has no real functionality — its description ('API client bindings') and README ('service client SDK') are boilerplate, index.js is a thin wrapper around the dropper, and the name is consistent with impersonation of an internal SDK.