If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (9dbec840b48cc522f6dcdda0ea3569cd85730d1fee219bd0b6ce46007917f61e)
On require, index.js loads _support.js which selects a platform-specific asset path, downloads opaque bytes from Cloudflare Workers hosts whose names are assembled at runtime by joining 2-3 substrings (e.g. oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), writes them to a temp file under a decoy name (dotnet_diag_<hex>.exe on Windows,.cache_<hex> on Unix), chmods 0755, and spawns the file detached via cmd.exe /c start on Windows or /bin/sh -c... & on Unix. A fallback delivery path queries DNS TXT records under c.net.dl.wel1.ru for a chunk count and then iterates i<n>.net.dl.wel1.ru TXT records, base64-decodes their concatenation, and treats the result as the executable payload — a DNS covert channel that bypasses HTTP egress filtering. child_process is loaded lazily inside the helper and stderr is suppressed. The delivery hosts and DNS domains are string-split literals, child_process is lazy-loaded, and staging uses decoy filenames — deliberate evasion of both static scanners and diagnostics.