If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (30a80297ae44091b682bf8fa68610f345348813d94b2c84e7f82a3183b938a94)
On require() of the package, index.js loads _ext.js which fetches an opaque platform-specific binary from hardcoded Cloudflare Workers hosts (oob-worker.cf101/cf102/cf103-*.workers.dev), writes it to /tmp or %TEMP% under a disguised name (dotnet_diag_*.exe on Windows,.cache_* on Unix), chmods 0755, and spawns it detached via cmd.exe/start or /bin/sh -c with stdio ignored and unref(). C2 hostnames and fallback domains are assembled from split-and-join string arrays to evade static analysis (e.g. ['sd','k.d','l.w','el1.','ru'].join('')). If HTTPS retrieval fails, the code reassembles the payload from base64-encoded DNS TXT records under *.dl.wel1.ru (sdk.dl.wel1.ru) via dns.resolveTxt and Buffer.from(...,'base64'), providing a covert channel resilient to endpoint/firewall filtering. A marker file analytics_state/.analytics_state provides TTL suppression to hide repeated executions. No hash or signature verification of the fetched payload; the child_process module is imported inside the activation path to further hinder static analysis.