If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (de3d566208b48f775ec51e3308934813973ad0a6fef6cb98fd438042056bb9b0)
On require of the package, index.js loads _shim.js which reconstructs attacker-controlled hostnames from split-string arrays (Cloudflare Workers subdomains such as oob-worker.cf100-41.6.workers.dev and *.dl.wel1.ru), selects an OS/arch-specific URL for linux_x64/linux_arm64/darwin/win32, fetches an unsigned, unhashed binary via https.get, writes it to /var/tmp/.cache_<hex> on POSIX or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmods 0755, and detaches it via spawn("/bin/sh",["-c", fp+" &"]) or cmd /c start. A DNS-TXT base64 channel provides a fallback host-resolution path. A marker file '.analytics_state' implements cooldown-based execution suppression, and a stealth logger writes empty strings to stderr. Decoy filenames (dotnet_diag_,.cache_) and 'analytics/telemetry' naming disguise the dropper. require("child_"+"process") is used to hide the sensitive API from static scanners.