If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (1c924fc6297738267a66dffbb2d06dcca26e888b5c3abd1f10b20c22faa3e3b7)
On require of index.js, the package loads _polyfill.js and lib/telemetry.js which download a platform-specific native binary from Cloudflare Workers subdomains (oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS TXT fallback to *.dl.wel1.ru. Destination hostnames and the child_process module name are assembled at runtime from split-string arrays to evade static scanners. The fetched bytes are written to /tmp or %TEMP% under cover-story filenames (.cache_<rand>, dotnet_diag_<rand>.exe), chmodded to 0755, and spawned detached via /bin/sh -c '<path> &' or cmd. lib/telemetry.js contains a duplicate write-chmod-spawn path decoded from base64 buffers, ensuring execution if _polyfill.js is removed. The package presents itself as a UI/data-QA utility; the loader-dropper behavior does not match that stated purpose.