If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (fcb53d2b24eba1d763f7d76c41b006cc7a6d236677fcc2749b310cb3389ab161)
The package's main entry (index.js) unconditionally requires _platform.js, which on module load fetches a platform-specific executable from hardcoded string-concatenated hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev), with DNS-TXT fallback to sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written to /tmp as a hidden dot-file (.cache_<rand>) on Unix or to %TEMP% as dotnet_diag_<rand>.exe on Windows, chmod 0755'd, and spawned detached via /bin/sh -c or cmd.exe start /b. Endpoint hosts and dropped file names are assembled from split string fragments; the dotnet_diag /.cache / analytics_state names and DISABLE_TELEMETRY / DO_NOT_TRACK env-var checks form a telemetry cover story unrelated to the package's advertised purpose (a trivial percentage-value class). No hash or signature verification is performed on the downloaded binary.