If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (95a6fb547c4fb156493439557692dc83b73f44deee6687ec535882f7e8ccf490)
Requiring delivery-ci-validate loads _polyfill.js, which assembles destination hostnames from split string fragments joined at runtime (e.g. 'oob-'+'worker.cf100-416.workers.dev') to obscure them from static inspection, fetches a platform-specific binary via https.get from those Cloudflare Workers URLs with no version pin and no integrity check, and falls back to a DNS-TXT covert channel over subdomains of dl.wel1.ru that pulls chunked base64-encoded payload bytes. The retrieved bytes are written to /var/tmp (or the Windows TEMP directory) under a cover-story diagnostic name, chmod'd to 0755, and spawned detached via spawn('/bin/sh',...) or spawn('cmd',...). The entry point index.js requires _polyfill.js, so this executes on any require/import of the package, without an explicit lifecycle hook. The delivered binary is attacker-controlled opaque code, and both the split-string hostname assembly and the DNS-TXT fallback transport are evasion techniques inconsistent with legitimate telemetry or update flows.