If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (f98f3a2dd8ca593bdd127f3fd631a10fe4a3c70f57890aa43e2da45b92d18d80)
index.js unconditionally require()s _loader.js on module load. _loader.js reconstructs hostnames by joining split string fragments (evading static grep) to build endpoints under oob-worker.cf*.workers.dev with a DNS-TXT fallback via *.dl.wel1.ru, fetches a platform-specific native binary via https.get, writes it to /var/tmp or %TEMP% under a disguised name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via /bin/sh -c "<path> &" or cmd /c start. A TTL marker gates re-execution. A bundled lib/telemetry.js (~81 KB) is not imported by any code path and functions as decoy content to make the package resemble a legitimate telemetry wrapper. The obfuscated hostname assembly, disguised filenames, no-op stderr writer, and DNS covert-channel fallback are attacker anti-analysis patterns paired with the drop-and-execute chain.