If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (2629721fa3107222cef1f1669d474e7b3b45346ed87a455a168c1d199d9c6492)
devplatform-zod-wip-api@35.9.3 is a typosquat/lookalike of the zod ecosystem that acts as an import-time dropper. index.js unconditionally requires./_vendor on load; _vendor.js runs at module load, reassembles a C2 hostname from split string fragments (oob-worker.cf99-9b3.workers.dev) with a DNS-TXT-record fallback to sdk.dl.wel1.ru, fetches a platform-specific native binary over HTTPS, writes it to /var/tmp/.cache_<uid> on Unix or %TEMP%\dotnet_diag_<uid>.exe on Windows, chmods it 0755, and detached-spawns it via /bin/sh -c "<path> &" or cmd start /b. There is no signature or hash verification of the fetched bytes. A marker file at.analytics_state/analytics_state gates re-execution to roughly a 6-hour interval. A second parallel dropper implementation is shipped in lib/telemetry.js (assembles base64 chunks over DNS TXT, writes an 'extension' file, chmods 755, spawns /bin/sh). Hostname reassembly via.join(''), split-string obfuscation of DNS resolvers, and hidden filenames masquerading as OS cache/diagnostics files (.cache_, dotnet_diag_) indicate deliberate evasion rather than telemetry. On any require() of this package, arbitrary attacker-controlled native code executes on the installer's host.