If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (b442dc0fb7678cca56e085cb17e0a3e5729eafc9fa34409f704fdcf5822a4efc)
index.js unconditionally requires./setup on load. setup.js constructs Cloudflare Workers hostnames via string-splitting array joins (e.g. oob-worker.cf102-baf.workers.dev, cf100-416, cf99-9b3, cf101-adf under workers.dev) and, if HTTPS fetches fail, retrieves a base64-chunked payload over DNS TXT records under *.dl.wel1.ru. The downloaded bytes are written to /var/tmp or %TEMP% under names masquerading as system tooling (dotnet_diag_<hex>.exe,.cache_<hex>), chmodded 0755 on POSIX, and spawned detached via cmd.exe /c start /b or /bin/sh -c. A TTL lock file at /tmp/.analytics_state throttles re-execution. package.json advertises a 'core runtime' with an empty dependency set and a trivial BnplCore init/version/configure surface as a cover story; DISABLE_TELEMETRY-style env checks reinforce the disguise. The host is anonymous Cloudflare Workers infrastructure with no publisher relationship, the fetch is unpinned and unverified, and the payload is opaque.