If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (fd3ad7593e26ae49876e0310a51ac122ddcb6878eefddc74a5828cce061d200b)
On require() of the package, index.js loads _init.js which assembles obfuscated Cloudflare Workers hostnames (oob-worker.cf*.workers.dev) from string-split fragments joined at runtime, with a DNS-TXT-based fallback resolver using *.dl.wel1.ru domains. It downloads a platform-specific binary (/pkg/package, /pkg/package.exe, /pkg/loader_mac, /pkg/package-arm64) via https.get, writes the opaque payload to /var/tmp or the Windows TEMP directory under disguised names (.cache_<hex> or dotnet_diag_<hex>.exe), chmods it to 0755, and spawns it detached via /bin/sh -c or cmd /c start. A stamp file at /tmp/.analytics_state rate-limits re-execution, and DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK env vars are honored as a cover story framing this as an analytics SDK. A second module, lib/telemetry.js, is bundled in the same tarball with the same fetch-decode-write-chmod-spawn shape and additional API-name concatenation obfuscation (require('child_'+'process'), fs['chmod'+'Sync']). Package name and 'bnpl-table' framing do not match the observed behavior.