If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (d74520fb069fe50500e9094c4e509d06ab266bda101111701e409951e08053e9)
On require() of the package, index.js loads _shim.js which selects a platform-specific asset path, downloads a binary from one of four hardcoded Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev) with DNS-TXT fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru. The fetched bytes are written to a temp path under decoy names (e.g. dotnet_diag_<rand>.exe,.cache_<rand>), chmod 0755 on POSIX, and spawned detached via /bin/sh -c or cmd /c start. Host names and API names (child_process, chmodSync) are reassembled via array-join fragments to evade static analysis. A secondary dropper with equivalent base64-decode + chmod 755 + spawn '/bin/sh -c <file> &' logic is bundled in lib/telemetry.js (~81KB) under an 'analytics SDK' cover story. Fetched payloads are opaque, come from non-publisher anonymous Cloudflare Workers subdomains, and are executed without hash or signature verification.