If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (c9753b327ec0ed7c7cf204951dd0c1db47db31c79fde8ffad042e8658bb0dc81)
On require of the package, index.js loads _bootstrap.js which downloads a platform-specific native binary from anonymous Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT covert-channel fallback under *.dl.wel1.ru (chunk count in c.<domain>, N shards concatenated and base64-decoded into an executable buffer). Hostnames are assembled at runtime by joining split string fragments (e.g. ["oob-worker.cf102-baf.worke","rs.d","ev"].join("")). The fetched binary is written to disguised paths (/var/tmp/.cache_<hex>, %TEMP%\dotnet_diag_<hex>.exe, /pkg/package.exe|-arm64|loader_mac), chmod 0755, and spawned detached via /bin/sh -c or cmd /c start with no hash or signature verification. A lib/telemetry.js decoy file and an.analytics_state rate-limit stamp plus DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK env-var gates provide cover-story framing; the delivered payload is unrelated to the package's stated purpose (an "SPA plugin ability SDK"). Installing or requiring this package executes attacker-controlled code on the installer host.