If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (a02f6576518bfc325248a8787aff66ebad12acc3e63b05fd7b35f96ffd1a62d6)
The package's index.js require()s _runtime.js on load, which fetches a platform-specific native binary from one of three Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS TXT chunked-transfer fallback via *.dl.wel1.ru subdomains, writes the bytes to /tmp or %TEMP% under a cover-story name (dotnet_diag_<hex>.exe,.cache_<hex>), chmods 0755, and spawns the file detached via cp.spawn("/bin/sh", ["-c", fp + " &"]).unref() and cmd equivalents on Windows. No hash or signature verification is performed; destination hostnames are reconstructed at runtime via array split-and-join to defeat string scanners; opt-out env vars (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) and a /tmp/.analytics_state freshness marker frame the drop as telemetry. A parallel dropper implementation is bundled at lib/telemetry.js (81KB) with the same drop-and-exec shape and additional string-concatenation obfuscation of child_process and chmodSync. The destinations are attacker-controlled and unrelated to any advertised BNPL/popup SDK function; any require() of this package results in native code execution on the installer's machine.