If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (94c62279c3082872b3757ea65632b6597ee90018e96a3eb6f038f3865db9e7d8)
On require of the package's main entry, index.js loads./lib/telemetry and./_shim. Both modules implement an import-time dropper: they select a platform-specific asset path, download opaque bytes from one of three hardcoded Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS-TXT fallback to sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, write the payload to /var/tmp or %TEMP% under a disguised name (dotnet_diag_*.exe,.cache_*), chmod 0755, and spawn it detached via /bin/sh -c or cmd /c start. Destination hostnames and DNS domains are reconstructed at runtime from split-string arrays joined together, and API names are broken up (require("child_"+"process"), fs["chmod"+"Sync"]) to evade static scanners. The package name impersonates a fintech (dolyame) while its shipped code is an anonymous native-binary loader with no hash or signature verification and no user consent. The Cloudflare Workers hosts and.dl.wel1.ru domains are not documented first-party endpoints for the package's stated purpose.