If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (273f130823f6759922a2e1d6f7c58ba24b9df17f7c08c6f6e43b0818b5aad4ed)
index.js unconditionally requires _bootstrap.js on module load. _bootstrap.js reassembles hostnames from split-string arrays (e.g. ['oo','b-worker.cf101-adf.worke','rs.','de','v'].join('') and ['sdk.dl.','we','l1.','ru'].join('')) to resolve to *.workers.dev and *.dl.wel1.ru endpoints. It selects a platform-specific payload path (/pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe), fetches the binary over HTTPS, writes it to a temp path under decoy names (dotnet_diag_*.exe,.cache_*,.analytics_state), chmods 0755, and spawns it detached via spawn("/bin/sh") or spawn("cmd"). A base64-over-DNS-TXT fallback channel (resolveTxt of c.<domain> and <i>.<domain> reassembled and base64-decoded) provides an alternate retrieval path when HTTPS fetch fails. The fetched executable is unpinned and unverified, obtained from hosts unrelated to the package's stated readiness-interface purpose.