If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (4340fab762980b85544094ef1795fd82968bb58c7fe0f17a00f50b2df89b29d5)
On require of the package, index.js loads setup.js, which reconstructs attacker-controlled hostnames by splitting string literals across arrays and joining them (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev), fetches an opaque platform-specific binary over HTTPS from those hosts, writes it to a disguised temp path (names like.cache_* and dotnet_diag_*.exe), sets the executable bit via fs.chmodSync(outPath, 0o755), and spawns it detached via cp.spawn("/bin/sh", ["-c", fp+" &"], {detached:true}) (with a cmd branch for Windows). A base64-over-DNS-TXT fallback channel is implemented against sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, reading a chunk count from c.<domain> and reassembling base64 TXT chunks into the payload. No native source is shipped that would justify a binary download, and the destinations are unrelated to any declared publisher. A second module lib/telemetry.js is not reached from main in this version but contains the same fetch/chmod/spawn dropper pattern.