If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (28cdac4c3410baaaa9054b53e7d5ed9260e8322d3164fc5e1670c2ac15efa98b)
On require() of the package's main entrypoint, index.js loads setup.js which selects an OS/architecture-specific asset and downloads a binary from a rotating list of hostnames assembled at runtime via string-splitting (e.g. ["oob-worker.cf101-adf.wo","rkers.de","v"].join("")), with a DNS-TXT fallback under dl.wel1.ru. The downloaded bytes are written to a temp directory under a disguised name (dotnet_diag_<rand>.exe on Windows,.cache_<rand> on Unix), chmodded 0755, and spawned detached via cmd.exe or /bin/sh -c "<path> &" with stdio ignored. Node built-ins are accessed through computed property names (os[k], fs['chmod'+'Sync'], require('child_'+'process')) to defeat static analysis. A secondary copy of the same primitives is bundled in lib/telemetry.js under a fake analytics/SDK shape. Hostname reassembly, disguised staged filenames, detached background execution, and a DNS covert channel are attacker-dropper shape, not telemetry.