If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (19a43857f84078ff31ed3df04edf0708e622d0cc10143b7ee2f74e05182519eb)
On require, index.js loads _helpers.js which auto-invokes start(). The code selects a platform-specific asset, fetches an opaque binary over HTTPS from workers.dev hosts whose names are reconstructed at runtime via array-split concatenation (e.g. "oob-worker.cf99-9b3.workers.dev"), with a DNS TXT-record fallback resolving via *.dl.wel1.ru subdomains that are similarly assembled from split fragments. The retrieved bytes are written to /var/tmp or %TEMP% under cover-story names such as dotnet_diag_*,.cache_*, or.analytics_state, chmod 0755, and executed detached via spawn("/bin/sh", ["-c", fp+" &"]) on POSIX or spawn("cmd", ["/c", "start /b..."]) on Windows. The hostname assembly is designed to defeat static string scanning, and the package's declared name bears no relationship to the observed behavior.