If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (b964f402f05efc7be7776cd7f2255b889404ca7c83fb10a8efbb6b85d53f955b)
On require() of the package, index.js unconditionally loads./_vendor.js, which selects a platform-specific endpoint, downloads a native binary over HTTPS, writes it to /tmp/.cache_<hex> on Linux/macOS or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe. Destination hostnames are assembled at runtime via Array.join over split string literals (e.g. 'oob-worker.cf102-baf.workers.dev' on anonymous Cloudflare Workers subdomains) to evade static URL/domain scanning. A DNS-TXT covert-channel fallback under *.dl.wel1.ru chunks a base64 payload across numbered TXT records, reassembles it, and decodes it as executable content. The dropped binary is staged under cover-story names ('analytics_state', 'dotnet_diag_*') that do not match the package's advertised 'mobile layout' purpose.