Malicious code in eacq-cdk (npm)

The npm package eacq-cdk was found to contain malicious code in its _init.js file that executes automatically when the package is required. The malicious code selects a platform-specific payload path and attempts to fetch an executable over HTTPS from attacker-controlled Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev). The hostnames are obfuscated by splitting them across character-shard arrays to defeat static string detection.\n\nIf HTTPS retrieval fails, the loader falls back to base64-encoded payload delivery via DNS TXT queries under *.dl.wel1.ru. The fetched executable is written to a hidden filename in /tmp (or Windows Temp), made executable with chmod 0755, and spawned detached via spawn('/bin/sh',...) or spawn('cmd',...) depending on the platform. The malicious behavior is framed as telemetry or analytics functionality.\n\nThe destinations and hostnames are unrelated to any legitimate publisher, indicating this is a supply chain compromise. Any project that installs this package grants full host code execution to the operator of the attacker-controlled endpoints upon first require of the package.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository.