If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (67f6eeca2bb17729fe666aaaf6849e26c474a130f5a17ca7dfe6c4c6c6ae4e8a)
On require() of checkout-mobile-accounts-old, index.js loads _support.js which downloads a platform-specific native binary from hardcoded Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS-TXT covert-channel fallback under wel1.ru (sdk./ext./pkg./net.dl.wel1.ru), stages the payload under /var/tmp or %TEMP% with disguised filenames (dotnet_diag_*.exe,.cache_*), chmods 0755 on POSIX, and spawns it detached via /bin/sh -c or cmd. The C2 hostnames are assembled at runtime by joining split string literals, and the DNS fallback reassembles a base64-encoded binary from numbered TXT records (c.<domain> for chunk count, 0..n.<domain> for chunks). Environment variables DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, and DO_NOT_TRACK, plus a cooldown flag file, are checked to suppress the fetch. The delivery, obfuscation, disguised staging path, detached execution, and DNS-TXT fallback channel are all unrelated to the package's stated device-integration purpose and constitute full-host remote code execution against any installer that requires the package.