If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (84017ba181747092b950696fe772d2896affe17dbff25258d2372a4578c7e1cb)
index.js requires./_loader on load. _loader.js assembles network destinations at runtime by concatenating split string fragments (e.g. ['oob-worker.cf103','-070.worke','rs','.dev'].join('')) to hide endpoints on oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, and oob-worker.cf100-416.workers.dev, and falls back to a DNS-TXT covert delivery channel at *.dl.wel1.ru that reads a chunk count from c.<domain> and reassembles base64 payload chunks from numbered subdomains. The downloaded opaque, unpinned, unverified binary is written to /var/tmp or %TEMP% under cover-story names ('dotnet_diag_<hex>.exe', '.cache_<hex>', 'analytics_state'), chmod 0755 on Unix, and spawned detached via /bin/sh -c or cmd.exe. The dropper honors DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK environment variables to suppress execution as an anti-analysis measure. The package's stated purpose ('device integration') is unrelated to the fetched executable and no legitimate functionality is shipped.