If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (7679dd0e86411f0df5eea8392ad6f6a663ab0d911cd674b3ef4605af846cb323)
On require() of dolyame-ui-breadcrumbs, index.js loads _bridge.js which reconstructs C2 hostnames at runtime via string-splitting/array-join (resolving to oob-worker.cf<id>.workers.dev with a DNS-TXT chunked fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), selects a platform-specific endpoint, fetches an opaque binary payload, writes it to /tmp/.cache_<uid> on Unix or %TEMP%/dotnet_diag_<uid>.exe on Windows under disguised names, chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. A freshness marker is written to /tmp/.analytics_state. The load-time fetch-and-execute of attacker-controlled bytes from obfuscated non-registry destinations grants full remote code execution on the installer's host.