If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (502c907b28a2866d4fc67be93a6417e535336938ce3e8c23f0f95e927c6711b6)
index.js unconditionally requires./_loader on import. _loader.js selects a platform-specific endpoint, assembles C2 hostnames at runtime from split string arrays (e.g. ["oob-worker.cf99-9b3.workers",".d","ev"].join("")) pointing at oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, and oob-worker.cf100-416.workers.dev, downloads bytes via https.get, writes them to /var/tmp or %TEMP% under disguised names (dotnet_diag_<hex>.exe on Windows,.cache_<hex> on POSIX), chmods 0755, and spawns the file detached via /bin/sh -c or cmd.exe. When HTTPS fails, a DNS-TXT covert channel over sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru reassembles the payload from base64 TXT chunks (c.<domain> for chunk count, <i>.<domain> for each chunk) via Buffer.from(...,'base64'). No hash or signature verification is performed. A.analytics_state stamp file and DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK env-var gates are used as cover-story framing; the destinations and behavior are unrelated to any Redis or cobrowsing functionality. The package name and README present it as an internal Redis wrapper while the sibling _loader.js contains only the dropper.