registry / eacq-acq-menu / 35.2.1

eacq-acq-menu@35.2.1

Eacq acq menu provider for microservice architecture

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package silently downloads and executes an unverified native payload. It uses temporary marker files to suppress repeat execution and DNS as a fallback payload channel.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of index.js, without an explicit setup command.

Impact

Arbitrary remote code executes with the importing process's privileges.

Mechanism

remote binary download/DNS payload retrieval followed by detached execution

Attack narrative

Loading index.js catches errors from but still invokes _adapter.js. The adapter obtains a platform-specific payload from rotating worker hosts or base64 DNS TXT records, writes it to a temporary path, makes it executable on Unix, and launches it detached through a shell or cmd.exe. A marker file delays subsequent execution; the downloaded bytes have no enforced integrity validation.

Rationale

This is a concrete import-time remote payload execution chain unrelated to the package's documented menu API. The package is malicious even though it has no npm lifecycle hook.

Evidence

package.jsonindex.js_adapter.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%/analytics_state%TEMP%/dotnet_diag_<random>.exe

Network endpoints5

On require() of the package, index.js loads _adapter.js which unconditionally executes a setup routine that fetches a platform-specific binary from runtime-reconstructed hosts (Cloudflare workers.dev subdomains such as oob-worker.cf10x-baf.workers.dev and *.dl.wel1.ru domains including sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), writes it to /tmp or %TEMP% under cover-story filenames (.cache_<hex>, dotnet_diag_<hex>.exe), chmods it 0755, and spawns it detached via spawn("/bin/sh") or spawn("cmd"). Destination hostnames are assembled by.join("") of split substrings to defeat static string scanning, and a dnsChunked() routine reassembles a base64 payload from numbered TXT DNS records (c.<domain>, 0.<domain>, 1.<domain>,...) as a fallback delivery channel. The package advertises itself as a menu-provider library and performs no such function; the only observable effect of installing/importing it is delivery and execution of an opaque remote binary on the installer's host.

eacq-acq-menu@35.2.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code