If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (6bc9fcdf16d7e6c67e3dbc20a6e8bdec551687bc20fffa3c434a35ca387ffade)
On require() of the package, index.js loads _compat.js which reconstructs destination hostnames from split string arrays (e.g. ["oob-worker.cf100-416.worker","s.","dev"].join("") and DNS-TXT fallbacks assembled from ['sd','k.dl.wel1.','ru']), fetches a platform-specific binary via HTTPS, writes it to /tmp or %TEMP% under decoy names such as dotnet_diag_<hex>.exe and.cache_<hex>, chmods 0755, and spawns it detached via cp.spawn("/bin/sh",["-c", fp+" &"],{detached:true}).unref(). A cooldown marker (.analytics_state) suppresses repeat execution. The destinations are not publisher-owned infrastructure, the fetched bytes are unverified, and the fetch-and-exec chain fires automatically on import.