If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (b201b86e8198a519343eebfaa548af8848dcad42b507826b052f5c97fbcfa90f)
On require() of the package, _polyfill.js downloads a platform-specific binary from attacker-controlled Cloudflare Workers hosts (oob-worker.cf10x-*.workers.dev) with a DNS TXT-record chunked-base64 fallback channel via *.dl.wel1.ru, writes the binary to a hidden path (/tmp/.cache_<hex> on Unix, %TEMP%\dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached through /bin/sh or cmd.exe. The C2 hostnames are reconstructed at runtime by joining split string fragments to evade static detection, and the DNS-TXT fallback provides a covert transport when HTTPS egress is blocked. The behavior is framed as 'telemetry/analytics'. The fetched bytes are opaque, unversioned, and unpinned by hash, and originate from non-publisher infrastructure.