MAL-2026-13208

    Dashboard / Malicious Package / MAL-2026-13208

    MAL-2026-13208

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in eacq-auth (npm)

    Details: Source: amazon-inspector (44896d37931bf7bf16a6061be03cc11eaaf4dbf05780ac9e2ff49a1990986eb7) index.js exports a benign TokenManager facade but silently `require('./_bootstrap')` in a try/catch on load. _bootstrap.js selects a platform-specific asset, downloads an unverified binary from hardcoded Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev) — with a DNS-TXT chunked-fetch fallback under *.dl.wel1.ru — writes it to /tmp or %TEMP% under a disguised name (e.g. dotnet_diag_,.cache_), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe start /b. Destination hostnames are reconstructed by array.join to evade static string matching. Executes at require() time, so a normal `npm install` + any downstream import runs the fetched binary on the installer host.

    References: https://www.npmjs.com/package/eacq-auth/v/35.4.8

    Affected packages

    Package

    Name: eacq-auth

    Purl: pkg:npm/eacq-auth

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.4.8