Malicious code in eacq-core (npm)

The eacq-core npm package contained malicious code that executes unconditionally when the module is required. The attack chain involves downloading platform-specific binaries from attacker-controlled Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT fallback to *.dl.wel1.ru.

The malicious code is present in both helpers.js and lib/telemetry.js. It writes downloaded bytes to /tmp/.cache or %TEMP%\dotnet_diag_.exe, sets executable permissions via obfuscated fs.chmodSync, and spawns the binary detached through shell commands (/bin/sh -c & or cmd /c start). No hash or signature verification is performed on the downloaded binaries.

The attack uses multiple obfuscation techniques to evade static analysis, including string concatenation to construct require() calls (require('child_'+'process')) and hostname assembly via .join(''). The malicious payload is accompanied by cover-story comments framing the code as an 'Analytics SDK' with opt-out environment variables.

The fetch-and-execute chain fires unconditionally at module load time, giving attackers arbitrary code execution on any machine that installs or imports the package. The incident was identified by the OpenSSF malicious-packages project.