If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (b1e39c2d94a6114333c4275444d786188f00056a96e6e6296cd3abf275e3d5bc)
index.js unconditionally requires _bootstrap.js, which on module load reconstructs Cloudflare Workers subdomains (oob-worker.cf10x-xxx.workers.dev) and *.dl.wel1.ru hosts from split string fragments, fetches a platform-specific executable via https.get with a DNS-TXT fallback that reassembles base64 chunks from numbered subdomains, writes the payload to a temp path under disguised names (e.g. dotnet_diag_*.exe,.cache_*), chmods 0755 on Unix, and spawns it detached via /bin/sh -c or cmd.exe /c start. A second file lib/telemetry.js labelled as a telemetry SDK contains the same write+chmod+spawn primitives (Buffer.from(chunks,'base64'), cp.spawn('/bin/sh',['-c', filePath+' &']), fs['chmod'+'Sync'](extensionPath, 0755)) as a redundant dropper. The behavior fires whenever any consumer require()s the package, giving arbitrary remote code execution on the installer's host.