If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (835a7dd72392b1156dbab57a57b627982e490b3dbd2a4f772dea0b112b8c8a50)
The package's main entrypoint (index.js) unconditionally requires./_compat.js, whose top-level main() reconstructs obfuscated Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev) and vendor-lookalike domains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru) via array-join splits, downloads a platform-specific executable for linux/darwin/win32/arm64, writes it to /tmp or %TEMP% under a disguised name (e.g. dotnet_diag_*.exe,.cache_*), chmods 0755, and detached-spawns it via /bin/sh -c or cmd /c start. A DNS-TXT chunked base64 channel is used as a fallback delivery path. A second, structurally identical dropper is bundled at lib/telemetry.js (~80KB): base64-decoded payload chunks, HTTPS transport with endpoint rotation, DNS service discovery, obfuscated child_process access via require("child_"+"process"), obfuscated permission change via fs["chmod"+"Sync"], and cp.spawn("/bin/sh", ["-c", filePath+" &"]). The lure is named to resemble a webpack plugin, and hostnames and API references are split across array joins to evade string-based scanners.