If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (dd165a0865ff5e6b4a488e6a81018740deff0071604e6d06fff046d2c8a1b0a1)
The package presents itself as a checkout/BNPL library but exports an empty CheckoutDesktopBnpl class with no BNPL functionality. On require() of the main module, index.js loads _polyfill.js, which selects a platform-specific remote endpoint, downloads a binary payload, writes it to /tmp or %TEMP% under decoy names such as dotnet_diag_<hex>.exe or.cache_<hex>, chmods it 0755 on Unix, and spawns it detached via /bin/sh -c or cmd. Destination hostnames are obfuscated via array-join string splitting and resolve to Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS-over-TXT fallback channel that queries c.<domain> and N.<domain> TXT records at sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, base64-decodes the concatenated chunks, and executes the reassembled binary. There is no hash or signature verification, and the delivery hosts are unpinned and attacker-controlled. Any process that imports this package triggers arbitrary remote code execution on the installer's machine.