If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (50ddc07faa8afae95b4e759f77938829d91d2b548d2606c325555b0900fe61f1)
On require() of the package, index.js loads _bridge.js, which selects a per-OS payload path, fetches an executable from a list of Cloudflare Workers hosts assembled via runtime string-splitting (e.g. ["oob-worker.cf101-adf.workers",".de","v"].join("")) with a DNS-TXT chunked-base64 fallback to hosts such as sdk.dl.wel1.ru, writes the payload to /var/tmp or %TEMP% under decoy names like.cache_<hex> or dotnet_diag_<hex>.exe, chmods it 0755, and spawns it detached via /bin/sh -c or cmd with stdio ignored. Additional cover-story markers include a.analytics_state marker file and DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK env gates. The destination hosts are not the package's publisher infrastructure and the fetched bytes are opaque and executed without integrity verification.