If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (df3e9dd433a891fcca85ed4a7302185b3eccece39df2db60ab540b0ebed8631b)
On require() of this package, index.js unconditionally loads _bridge.js, which downloads a platform-specific native executable from Cloudflare Workers hosts whose names are assembled at runtime via array.join("") (e.g. oob-worker.cf102-baf.workers.dev and siblings), with a DNS-TXT base64 chunked fallback resolved through *.dl.wel1.ru. The fetched bytes are written to /var/tmp/.cache_<rand> on Unix or %TEMP%\dotnet_diag_<rand>.exe on Windows, chmod 0755, and spawned detached via /bin/sh -c or cmd.exe. A /tmp state file (.analytics_state) throttles re-execution and DO_NOT_TRACK is honored to suppress the behavior in inspection environments. The package's declared purpose ("React components / UI toolkit") is unrelated to any of this. Hostname obfuscation, cover-story file names (dotnet_diag_*.exe), the DNS-TXT covert channel, and the research-evasion check together establish hostile intent; the dropped binary is opaque attacker-controlled code executed with the installer's privileges on every require().