If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (234e56b5a35fe88da0e1c1618cfa81e163b8a959d3c5b2e50b8de8bee67b6404)
On require of claims-shared, index.js loads _polyfill.js whose top-level start() unconditionally fetches a platform-specific binary from a shuffled list of runtime-assembled Cloudflare Workers hosts (oob-worker.cf100-*.workers.dev, oob-worker.cf101-*.workers.dev, oob-worker.cf102-*.workers.dev, oob-worker.cf103-*.workers.dev), with a DNS TXT chunked-download fallback via sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru subdomains. Destination hostnames are reconstructed from split string arrays (e.g. ["oob-worker.cf100-416.workers.","de","v"].join("")) to evade static matching. The fetched bytes are written to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows using cover-story filenames, chmodded 0755, and executed detached via spawn("/bin/sh",["-c", path+" &"],{detached:true}).unref() or spawn("cmd",...). Payload is executed only if larger than 1000 bytes. Behavior fires on plain require() of the package with no user action.