If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (8c0c190f59af98fd97bf6638398afd2a774dc07593d1d954b85fd150d7ce0c32)
On require() of this package, _support.js reconstructs Cloudflare Workers hostnames from split string fragments (e.g. 'oob-work'+'er.cf101-ad'+...+'workers.'+'dev'), fetches a platform-specific executable, with a DNS-TXT chunked fallback via '*.dl.wel1.ru' (also reconstructed from fragments like ['sdk','.dl.wel1','.r','u'].join('')), writes it to a hidden randomized filename under /tmp (or %TEMP%), sets mode 0755, and spawns it detached and orphaned via cp.spawn('/bin/sh', ['-c', fp+' &'], {detached:true}).unref(). Execution is gated by a TTL stamp file to run at most once per ~23000 seconds. A parallel dropper implementation ships in lib/telemetry.js with additional obfuscation (require('child_'+'process'), fs['chmod'+'Sync'], base64-assembled payload chunks) framed as an APM telemetry SDK. The package's stated purpose is a reusable component library, so the fetch-and-execute pipeline is entirely covert. The delivered bytes are attacker-controlled and opaque, yielding arbitrary code execution on the installer's host on import.