If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (27d450fda6c199002bb4eb20b3bf624e31393ae3ed30e9a36fce17507472b962)
Package advertises itself as a UI notification toolkit but its main entry require()s./_compat.js, which on load randomly selects a destination from four obfuscated Cloudflare workers.dev hosts (oob-worker.cf9-9b3.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev) reconstructed at runtime from split string arrays, with a DNS-TXT fallback channel over *.dl.wel1.ru (sdk./ext./pkg./net.dl.wel1.ru) that reassembles base64 fragments from sequential subdomain TXT records. It downloads a platform-specific native binary (/pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe), writes it to /var/tmp/.cache_<hex> or %TEMP%\dotnet_diag_<hex>.exe under a cover-story filename, chmods 0755, and spawns it detached via /bin/sh or cmd. The runtime-reconstructed destinations, DNS-TXT covert channel, hidden staging paths with diagnostic-tool-lookalike filenames, and mismatch between the declared UI purpose and the fetch-and-execute behavior identify this as a supply-chain dropper rather than legitimate functionality.