If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (d77aab31095b1d13ea26c5ca29398e01a205ed0766fe95d5d8978751ebd75e35)
The package presents itself as a 'logging middleware' but its index.js unconditionally requires _loader.js on module load. _loader.js selects a per-OS asset and fetches it over HTTPS from a randomized list of anonymous Cloudflare Workers hostnames (reconstructed via split-string concatenation such as ["oob-wor","ker.cf100-416.workers",".de","v"].join("")). If HTTPS fails, it falls back to a DNS TXT covert channel that queries c.<host> then sequential numeric subdomains under *.dl.wel1.ru, concatenates the TXT chunks, and base64-decodes them into an executable payload. The fetched bytes are written to a disguised path under /var/tmp or %TEMP% (e.g. dotnet_diag_*.exe,.cache_*), chmod 0755 on Unix, and executed detached via cp.spawn("/bin/sh", ["-c", fp + " &"], {detached:true}) or cmd.exe. No hash or signature verification is performed, destinations are not publisher-controlled, and hostnames and the require("child_"+"process") call are string-split to evade static scanners. The Logger export is a cover story shadowing an install/import-time remote-code-execution dropper.