If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (1d867d807ef1166d65944d4f860b0cd74fe9d6da956c460542b0430b4fae66bd)
On require of the package, index.js loads _shim.js which reconstructs a set of Cloudflare Workers hostnames (oob-worker.cf101-adf/102-baf/99-9b3/103-070.workers.dev) and DNS-TXT fallback domains (sdk/ext/pkg/net.dl.wel1.ru) from array fragments joined at runtime, downloads an opaque binary over HTTPS (with a DNS-TXT chunked base64 covert channel as fallback when HTTPS egress is blocked), writes it to /tmp or the Windows temp directory under disguised names such as.cache_<rnd> or dotnet_diag_<rnd>.exe, chmods it to 0755, and spawns it detached via /bin/sh -c '<path> &' or cmd /c start. Destination hostnames are obfuscated via string-split-and-join to evade static detection. Installing or importing this package results in execution of attacker-controlled native code on the host with the installer's privileges.