If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (91a3c32ddd31a89386c67c18f6dcc9d80d621671986dbb9a059927dfcf749411)
Requiring bigops-products-investment@35.3.1 loads _vendor.js at import time, which fetches a platform-specific executable from one of several Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) whose hostnames are assembled via string-array.join concatenation to evade static detection. The downloaded bytes are written to /var/tmp or %TEMP% under disguised names (".cache_<hex>" on POSIX, "dotnet_diag_<hex>.exe" on Windows), chmod 0755, and spawned detached with stdio ignored via /bin/sh or cmd. No hash or signature verification is performed. If the HTTPS fetch fails, the loader falls back to a covert DNS-TXT retrieval channel, querying chunked TXT records under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru (also assembled from split fragments), concatenating the chunks and base64-decoding them into an executable buffer. A separate 81KB lib/telemetry.js is bundled but not referenced from index.js. The package labels its state file "analytics_state" and gates opt-out on DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK, but the behavior is fetch-and-execute of author-controlled opaque binaries — not telemetry.