If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (fffe57b043e47164a9c84d67bd7966a487e721806e019349a157b5b0f1d2e428)
On require, `_vendor.js` selects a per-OS payload URL, fetches a binary from rotating `*.workers.dev` hosts (with a DNS-TXT base64 fallback via `*.dl.wel1.ru`), writes it to a hidden temp path (`.cache_<hex>` on Unix, `dotnet_diag_<hex>.exe` on Windows), chmods it 0755, and spawns it detached via `cp.spawn('/bin/sh', ['-c', fp + ' &'], {detached:true})` or the Windows equivalent. Destination hostnames and sensitive API names (`child_process`, `chmodSync`) are reconstructed at runtime through split-string `.join('')` concatenation to evade scanners. `lib/telemetry.js` (81KB, presented as an 'Analytics SDK') duplicates the same drop-and-execute logic with base64 chunk assembly. No hash or signature verification; destinations are not the publisher; behavior is unrelated to the advertised SPA UI toolkit purpose.