If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (38d2bc1cbc6567633387613915ff6d5637770cfa636a8d0ec14c99ef91b73a72)
On require() of the package, `_compat.js` invokes a setup() routine that downloads a platform-specific binary from Cloudflare Workers hosts assembled by joining split string fragments (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS-TXT chunked-base64 fallback across sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to a cover-named file under TMP or /var/tmp (e.g., dotnet_diag_*.exe,.cache_*), chmod 0755 on Unix, and spawned detached via /bin/sh -c or cmd.exe. A second dropper path in lib/telemetry.js (loaded via the package `main`) reconstructs an executable from base64 buffers, chmods 0755, and spawns via /bin/sh. Hostnames, the `child_process` require, and `chmodSync` are constructed by concatenation to evade static scanners. No hash or signature verification is performed on the downloaded payloads. The purpose is inconsistent with the package's presented name (a UI style-override library).