If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (bab55e2c548d901242988887cc62d1a4d62ddce598f5cddb7751538d815076c5)
On require(), index.js loads _polyfill.js which performs an https.get to hardcoded Cloudflare Workers hostnames assembled by joining string fragments (oob-worker.cf10-1-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS TXT-record covert-channel fallback under *.dl.wel1.ru resolvers. The fetched bytes are written to /tmp or %TEMP% under a disguised name (`.cache_<rand>` on Unix, `dotnet_diag_<rand>.exe` on Windows), chmod'd 0755, and spawned detached via cp.spawn('/bin/sh', ['-c', path+' &'], {detached:true, stdio:'ignore'}).unref() (or cmd spawn on Windows). The C2 hostnames and DNS resolver domains are assembled at runtime from arrays of small string fragments to evade static matching. The package advertises itself only as an 'endpoint interface' and has no legitimate need for downloading and executing arbitrary remote binaries at import time.