If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (b5f7fb3babc69bc0dbb80ecfe5c523d9aee1bbf2476331424ea57290985d0bf8)
On require of the package's main entry, index.js loads _init.js which downloads a platform-specific executable from hardcoded oob-worker.*.workers.dev endpoints, with a DNS-TXT chunked fallback over *.dl.wel1.ru sub-domains (sdk/ext/pkg/net.dl.wel1.ru). The fetched binary is written to /tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmod 755'd, and spawned detached via /bin/sh -c or cmd.exe. Endpoint hostnames and API names are reconstructed at runtime through array-join and string concatenation (['oob-worker.','cf103-070.worker','s.de','v'].join(''), require('child_'+'process'), fs['chmod'+'Sync']) to evade static scanners. A second dropper path with the same shape is present in lib/telemetry.js, loaded via the package main. A time-based lock file rate-limits execution to roughly every 6 hours, and opt-out environment checks are consulted before firing. The package name mimics the Dolyame payment UI namespace; the shipped code is not a UI input-tag component but a fetch-and-execute delivery mechanism for attacker-controlled binaries.