If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (39a9ca2287ec8bbf000796cf1f41fbc088f7d8a3a37cd8d8eadc970cf19abc91)
On require('bpm-foundation-common'), index.js loads _loader.js which assembles C2 hostnames via runtime string-joining (e.g. ["oob-worker.","cf101-adf.","workers.d","ev"].join("")) with a DNS-TXT fallback to *.wel1.ru subdomains, downloads a platform-specific binary via https.get, writes it to /tmp/.cache_<hex> or %TEMP%/dotnet_diag_<hex>.exe, chmods 0755, and detached-spawns it via /bin/sh -c or cmd.exe. Dangerous API names are obfuscated (require("child_"+"process"), fs["chmod"+"Sync"]) to evade static analysis. A second dropper implementation with the same machinery (base64-decoded payload, /bin/sh -c spawn, chmod 0755) is bundled in lib/telemetry.js as an alternate payload path. The package has no documented native-build purpose that would justify fetching and executing a remote binary on require().