If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (1a9b7cb00a4aac61795c81a085319cb8b0ac0aff1350a0dafddb4ef31d25a15f)
On require of the package, index.js unconditionally loads _shim.js, which fetches a platform-specific binary from obfuscated Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS TXT-record fallback channel via sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. Hostnames are assembled at runtime by joining split string fragments to evade static detection. The fetched payload is written to /tmp or %TEMP% under disguised names (.cache_<rand>, dotnet_diag_<rand>.exe), chmod 0755 on Unix, and spawned detached via /bin/sh -c or cmd with stdio ignored. The DNS fallback base64-decodes numbered TXT chunks to reconstruct the payload when HTTPS fetches fail. An anti-re-run stamp gates repeated execution. The delivery infrastructure, string-split hostname obfuscation, disguised on-disk filenames, and DNS covert channel are canonical malicious dropper fingerprints.