If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (15f91ac3c4278628875a5c009c515bcdb5fbc8b885eb32dff56e4367c5babf66)
On require, index.js loads _bootstrap.js which downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints (hostnames assembled at runtime via string-splitting/Array.join, e.g. ["oob-worker.cf100-416.work","ers.dev"].join("")), writes it to a temp path under a decoy name, chmods 0755 on Unix, and spawns it detached via /bin/sh -c '<path> &' (or cmd on Windows). A DNS TXT-record covert channel over *.dl.wel1.ru subdomains serves as a fallback to reassemble a base64 payload. Sensitive Node API references (require("child_"+"process"), fs["chmod"+"Sync"]) are similarly split to evade static analysis. lib/telemetry.js ships a second copy of the same dropper primitives (base64 chunk assembly, /bin/sh spawn, chmod 755) styled as a Sentry-like telemetry SDK with opt-out env-var cover comments. The delivered bytes are attacker-controlled and mutable, giving arbitrary code execution on the installer's host on module load.