MAL-2026-13514

Dashboard / Malicious Package / MAL-2026-13514

MAL-2026-13514

Summary: Malicious code in eacq-core (npm)

Details: Source: amazon-inspector (b500358c69db5b11d186a6656bd7e20b6ae98cf8f8b437af7b320d511f870761) On require() of eacq-core, both _helpers.js and lib/telemetry.js download a platform-specific binary from Cloudflare Workers hosts assembled at runtime via string-splitting (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT fallback to *.dl.wel1.ru, write the bytes to /tmp/.cache_<rand> or %TEMP%\dotnet_diag_<rand>.exe, chmod 0755 (via fs['chmod'+'Sync']), and spawn the file detached through '/bin/sh -c <path> &' or 'cmd /c start'. No hash or signature verification is performed and the destinations are unrelated to any legitimate publisher. child_process is loaded through require('child_'+'process') and hostnames are assembled via.join('') to evade static analysis. Cover-story comments framing the code as an 'Analytics SDK' with 'opt-out env vars' accompany the payload. The fetch-and-execute chain fires unconditionally at module load, giving whoever controls the Workers hosts arbitrary code execution on any machine that installs or imports this package.

References: https://www.npmjs.com/package/eacq-core/v/35.8.1