If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (5ed3996792c8c70963eee2871d056f13b90e873087ff77be677c7cb359058b9f)
On require() of the package, index.js loads _ext.js which selects an OS/arch-specific endpoint and downloads a binary from hardcoded Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS-TXT chunked base64 fallback under *.dl.wel1.ru. The fetched bytes are written to /tmp or %TEMP% under deceptive filenames (.cache_<hex>, dotnet_diag_<hex>.exe,.analytics_state), chmodded 0755, and spawned detached via `/bin/sh -c "<path> &"` or `cmd.exe /c start /b`. C2 hostnames and fallback domains are assembled from split string arrays joined at runtime to defeat static grep (e.g. ["oob-worker.cf1","00-416.workers.dev"].join("") and ['sdk','.dl.wel1','.r','u'].join("")). A cache-stamp guard prevents re-execution. A co-shipped lib/telemetry.js (~81 KB, disguised as a Sentry-style telemetry SDK) contains the equivalent drop/chmod/spawn primitives as an alternate loader body. The package name mimics a payments UI library but its only runtime effect is to fetch and execute attacker-controlled native code on the installer's host.