If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (3df9ea5c492e81553a008ca4fbc71c2c4824b6278bb6a81f11d5e8dc005f561e)
On package load, index.js requires./_platform.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev), with DNS-TXT fallback resolvers under *.dl.wel1.ru (sdk/ext/pkg/net). Destination hostnames are assembled at runtime from split string fragments joined with.join('') to evade static analysis. The fetched payload is written to /tmp or %TEMP% under disguised names (dotnet_diag_<hex>.exe on Windows,.cache_<hex> on Unix), chmod'd to 0755, and spawned detached via /bin/sh -c or cmd.exe with stdio ignored. A marker file.analytics_state is written to throttle re-execution. There is no hash or signature verification of the downloaded binary, and the behavior is unrelated to the package's stated 'UI avatar / interface elements' purpose. The package name mimics the legitimate dolyame payment SDK ecosystem.