If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (37df8b5a29c08cca1da2d6cc77c5672f9c23ce6877b148c3bef277d0dbaa1d4e)
index.js requires./_polyfill on module load. _polyfill.js selects a platform-specific branch (linux_x64, linux_arm64, darwin, win32), assembles destination hostnames via per-character string joins (e.g. Cloudflare Workers hosts under oob-worker.cf*.workers.dev and a discovery domain under sdk.dl.wel1.ru), downloads an opaque binary, writes it to /tmp or %TEMP% under a disguised name such as.cache_<rand> or dotnet_diag_<rand>.exe, chmods 0755 on Unix, and spawns it detached via /bin/sh -c '<path> &' or cmd /c start. A DNS TXT fallback reconstructs the payload from base64-chunked TXT records served across numbered subdomains (c.<domain> for count, i.<domain> pieces joined and base64-decoded) when HTTPS retrieval is blocked. The destinations are non-publisher, string-obfuscated hosts; the fetched bytes are executed on the installer's machine at library load with no signature, hash, or publisher verification.