If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (f80a4ff82e37de309fbc903891bd8ac770f0542251e9b4afc15fbd36e94ac21c)
On require, index.js loads _shim.js, which fetches a platform-specific native executable from hardcoded hosts reconstructed at runtime via array `.join('')` to evade string search: `oob-worker.cf102-baf.workers.dev`, `oob-worker.cf103-070.workers.dev`, `oob-worker.cf99-9b3.workers.dev`. The fetched bytes are written to /tmp or %TEMP% under cover-story names (`dotnet_diag_*.exe`, `.cache_*`), chmodded 0755, and spawned detached via `spawn('/bin/sh', ['-c', fp + ' &'], {detached:true})` or `spawn('cmd',...)`. A DNS-over-TXT covert channel provides fallback delivery: `dns.resolveTxt` is used against `c.<domain>` and `<i>.<domain>` under `sdk.dl.wel1.ru`, `ext.dl.wel1.ru`, `pkg.dl.wel1.ru`, `net.dl.wel1.ru`; TXT records are base64-decoded, concatenated into an executable buffer, written to disk and spawned. A state file `.analytics_state` is maintained. The package's declared name ("session management") does not justify fetching or executing native binaries, and none of the destinations are publisher-owned or version-pinned; the delivered bytes are opaque, un-hashed, and mutable at the operators' discretion.