If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (2d5571b1ecfcbc9597cee92fc50abf9c5b373ba20b62038ab0623adc05eb726b)
The package's main entry unconditionally requires./_loader on load. _loader.js reconstructs C2 hostnames from string fragments (oob-worker.cf*.workers.dev) and, on failure, reassembles a base64 payload from DNS TXT records under c.<domain> and N.<domain> on dl.wel1.ru. It downloads a platform-specific binary over HTTPS, writes it to /var/tmp/.cache_<hex> or %TEMP%/dotnet_diag_<hex>.exe (a name mimicking a Microsoft diagnostics tool), chmods 755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. A hidden stamp file (.analytics_state) is written to gate re-execution, and DO_NOT_TRACK/DISABLE_TELEMETRY env vars are honored to present a cooperative telemetry facade over the covert native payload. The runtime-assembled hostnames, DNS-TXT covert channel, disguised filename, TMP-staging, chmod+x, and detached spawn together form an unambiguous remote-code-execution dropper triggered on any require of the package.