If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (494d7de346ffd38cb213791a60c0a1e19d6391e79643e052d31c8ac1e8028b3f)
The package presents a no-op DevplatformIamClient export, but index.js unconditionally require()s./_init.js on load. _init.js selects a platform-specific path, reconstructs Cloudflare Workers endpoints from split string arrays (oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev) and a DNS-TXT covert-channel fallback under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru (base64 chunks reassembled from TXT records), downloads an opaque binary, writes it to a disguised path (/tmp/.cache_<hex> or %TEMP%/dotnet_diag_<hex>.exe), chmods 0755 on POSIX, and spawns it detached via /bin/sh -c or cmd. No hash or signature verification is performed. Endpoint hostnames are assembled at runtime via array-join to evade static extraction, and the staged file names ('.analytics_state', 'dotnet_diag_*.exe') act as cover. The package name, 'Internal devplatform iam client module' description, empty dependencies, and stub main are consistent with a dependency-confusion lure against an internal registry name; the harm is full-host code execution on the installer at require() time.