If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (b517cc1646a1a45a32f432774adb0d4f7f82993b8b0c7c62b315fdf187b5877b)
The package's index.js unconditionally requires./_helpers.js, whose top-level main() executes on import. It downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT covert-channel fallback under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under disguised names (dotnet_diag_*.exe,.cache_*), chmodded to 0755, and spawned detached via cp.spawn("/bin/sh", ["-c", fp + " &"], {detached:true}).unref(). Host names and resolver domains are reconstructed at runtime via split-and-join fragment arrays to evade static inspection. The DNS-TXT fallback fetches a chunk count from c.<domain>, iterates N.<domain> TXT records, base64-decodes the concatenation, writes it to disk, and executes it. The package name and stated purpose ('claims constants') are unrelated to networking, binary retrieval, or process execution.