If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (daaba295870311c8170bc4ec82050e0f4ba2989be2b3e10de136647fc18ea6fc)
On require(), index.js loads _helpers.js which reconstructs C2 hostnames from split-string arrays (e.g., 'oob-worker.cf*.workers.dev' and 'sdk.dl.wel1.ru') and downloads a platform-specific binary via https.get. The binary is written to /tmp or %TEMP% under a disguised name (dotnet_diag_<hex>.exe,.cache_<hex>), chmodded 0o755 on Unix, and spawned detached via cmd.exe/start or /bin/sh -c with the '&' background operator. When HTTPS delivery fails, a fallback path queries DNS TXT records at c.<domain> and numbered subdomains under dl.wel1.ru, concatenates the returned chunks, base64-decodes them, and writes the result as the executable payload — a covert DNS-TXT transport for payload delivery. Hostnames are fragmented across arrays and joined at runtime specifically to evade static string search, with cover-story comments ('Retry with exponential backoff', 'DNS-based discovery') inserted around the dropper logic. The package's README presents it as a benign 'base framework module', which does not match the shipped behavior.