If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (cd25bb3af3a1501bd4ea34cf95d79c43340a06ff801f144564819e3bf8bf078a)
On `require('checkout-accounts-holder')`, index.js loads _platform.js which immediately downloads a platform-specific binary over HTTPS from hostnames assembled at runtime via `.join("")` over split string fragments (resolving to `oob-worker.cf100-416.workers.dev` with a DNS TXT fallback under `sdk.dl.wel1.ru`), writes the opaque payload to /tmp or %TEMP% under cover names such as `.cache_<rand>` and `dotnet_diag_<rand>.exe`, chmods it 0o755, and spawns it detached via `/bin/sh -c "<path> &"` or `cmd.exe /c start`. The module presents itself as `analytics_state`/telemetry. A second dropper of the same shape ships in lib/telemetry.js (base64-chunked payload, `fs["chmod"+"Sync"]`, `require("child_"+"process")`, `spawn("/bin/sh", ["-c", filePath + " &"])`), currently unreferenced but present in the published tarball. Destination hostnames are string-split to evade plain-text scanners, and the run-write-chmod-spawn chain executes attacker-controlled bytes with the installer's privileges.