If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (74230ed898152bc75d702938fcac9bd53e13ff7100120b44c5944bb8226225f7)
index.js unconditionally requires./_compat on load, which selects a platform-specific asset path (linux/darwin/win32) and downloads bytes over HTTPS from string-obfuscated Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS-TXT base64 fallback channel under *.dl.wel1.ru. The downloaded payload is written to /var/tmp (or the Windows TEMP directory) under a disguised name resembling dotnet_diag_*.exe /.cache_*, chmodded to 0755, and spawned detached via /bin/sh -c '<file> &' or cmd /c start with stdio ignored. Destination hosts are assembled from split string fragments (e.g. ["oob-worker.cf","103-070",".worker","s.","de","v"].join("")) and child_process / chmodSync are required via string concatenation (require("child_" + "process"), fs["chmod" + "Sync"]) to evade static URL and API scanning. The same download-then-execute chain is duplicated in lib/telemetry.js (81KB). There is no version pinning, no hash or signature verification, and the destinations are unrelated to a UI notification library.