If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (92dcd946aaaf9b57795f9a94877df34a69ac39828620c58e2cf4b72cd7a9c253)
On require(), index.js loads _loader.js, which reconstructs Cloudflare Workers hostnames from split string fragments (e.g. ['oob-worke','r.cf101-a','df.workers.d','ev'].join('')) and a DNS-TXT fallback channel via fragmented 'sdk.dl.wel1.ru' resolvers, downloads a platform-specific binary, writes it to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmods it 0o755, and spawns it detached via cp.spawn('/bin/sh',['-c', fp+' &']) or spawn('cmd',...). The dropped artifacts use names impersonating telemetry / dotnet diagnostics, and environment variables like DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK are honored to provide a cover story. The package has no jscodeshift-plugin functionality and appears to be a name-squat lure whose only purpose is dropping and executing this remote payload.