If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (03f8408e0f3ee2e4d802003cc54666a1e535bbd512e8515d1ef3b7a63acf16d8)
On require of the package's main entry, index.js loads./_support.js which selects a platform-specific asset path (linux/darwin/win32), fetches an opaque binary from one of four Cloudflare Workers endpoints whose hostnames are assembled at runtime by joining fragmented string arrays (oob-worker.cf{99-9b3,101-adf,102-baf,103-070}.workers.dev), with a DNS-TXT covert-channel fallback via {sdk,ext,pkg,net}.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmod'd 0755, and spawned detached via /bin/sh -c or cmd.exe. A persistence marker at /tmp/.analytics_state prevents re-execution. A parallel dropper implementation is bundled in lib/telemetry.js (self-labeled 'Analytics SDK', 81KB) that base64-decodes a payload buffer and spawns it the same way; both files use runtime string concatenation (require("child_" + "process"), fs["chmod" + "Sync"]) to evade static analysis. The obfuscation, disguised filenames mimicking diagnostic tooling, DNS-TXT fallback, and dual dropper implementations have no legitimate purpose.