If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (3b7f73dabdc94daaab90ab1d45fafabe4ba6c223dd00c4f989f8237c9ecd54b2)
On require() of this package, index.js loads _helpers.js which runs at import time. The module assembles three attacker-controlled hostnames from split string fragments joined at runtime (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), selects a platform-specific endpoint, fetches an opaque binary via https.get, writes it to /var/tmp or %TEMP% under a disguised filename (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via spawn("/bin/sh", ["-c",...]) or spawn("cmd",...). A DNS-TXT chunked base64 covert-channel fallback contacts *.dl.wel1.ru when the HTTPS hosts are unreachable. Additional evasion: require("child_" + "process") string concatenation in lib/telemetry.js, environment-variable gating on DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK, and a filesystem session stamp to fire once per host. The disguised filenames (dotnet_diag_,.cache_) impersonate legitimate diagnostic artifacts. The package name resembles a checkout/test utility but ships no functionality matching that purpose.