eacq-api@35.6.1: Malicious npm security report (Block)

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package silently retrieves a binary payload and executes it detached. The behavior is not part of the minimal exported API.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Runtime require/import of index.js.

Impact

Arbitrary native code execution under the importing user's account.

Mechanism

Remote binary download/DNS staging, temporary-file drop, permission change, and detached execution.

Attack narrative

The public entrypoint silently requires _compat.js. On import, it records a temporary marker, downloads a platform-specific payload from obfuscated workers.dev hosts or reconstructs one from DNS TXT records under wel1.ru, writes it to a temporary directory, marks it executable on Unix, and starts it detached via shell or cmd.exe. This creates remote code execution without user action.

Rationale

This is concrete import-time remote payload staging and execution, with obfuscated fallback infrastructure and throttling. Absence of an npm lifecycle hook does not mitigate the reachable runtime execution.

Evidence

package.jsonindex.js_compat.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%/analytics_state%TEMP%/dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf101-adf.workers.devoob-worker.cf103-070.workers.devoob-worker.cf102-baf.workers.devoob-worker.cf100-416.workers.dev

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-13207

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in eacq-api (npm)

Details

On require() of eacq-api, index.js loads _compat.js which reconstructs C2 hostnames from string-split fragments (oob-worker.cf10{0,1,2,3}-*.workers.dev) and a DNS TXT chunked-base64 fallback channel over *.dl.wel1.ru subdomains (sdk/ext/pkg/net). getBinary() downloads a platform-specific opaque binary over HTTPS (or via the DNS TXT fallback), writes it to a disguised path under /tmp or %TEMP% such as dotnet_diag_<hex>.exe or.cache_<hex>, chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe. Execution is gated only by a filesystem cooldown marker and env opt-out flags; there is no hash or signature verification of the fetched bytes despite a comment claiming SHA-256 checking. The delivery infrastructure (anonymous Cloudflare Workers hosts + a DNS TXT covert channel) is unrelated to any legitimate API-client purpose, and the endpoint reconstruction plus alternate DNS transport indicate deliberate evasion of static scanners.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.js imports _compat.js on every package import.
_compat.js downloads platform payloads from shuffled workers.dev hosts.
_compat.js falls back to DNS TXT payload retrieval from *.wel1.ru.
_compat.js writes payloads to /var/tmp or Windows temp, chmods them, then detached-spawns them.
A /tmp analytics marker throttles repeat execution and errors are suppressed.

Evidence against

package.json has no lifecycle scripts.
lib/telemetry.js native-profiler path requires explicit caller-supplied configuration; _compat.js is the automatic trigger.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 84.4 KB of source

Source & flagged code

5 flagged

_compat.jsView file

5const os = require("os"); L6: const https = require("https"); L7: const fs = require("fs"); ... L47: const COOLDOWN = 22857; L48: const _l = (...a) => process.stderr.write(""); L49: ... L58: const isWin = _p("platform") === "win32"; L59: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L60: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L91: try { L92: require("dns").resolveTxt(d, (e, rr) => { L93: if (e || !rr || !rr.length) return r("");

Critical

Download Execute

Source downloads or fetches remote code and executes it.

_compat.jsView on unpkg · L5

5Trigger-reachable chain: manifest.main -> index.js -> _compat.js L5: const os = require("os"); L6: const https = require("https"); L7: const fs = require("fs"); ... L47: const COOLDOWN = 22857; L48: const _l = (...a) => process.stderr.write(""); L49: ... L58: const isWin = _p("platform") === "win32"; L59: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L60: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L91: try { L92: require("dns").resolveTxt(d, (e, rr) => { L93: if (e || !rr || !rr.length) return r("");

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

_compat.jsView on unpkg · L5

120try { L121: const cp = require("child_process"); L122: if (isWin) {

High

Child Process

Package source references child process execution.

_compat.jsView on unpkg · L120

•matchType = token_shingles matchedPackage = beaver-ui-storybook-addon-code-description@35.7.7 matchedPath = _loader.js matchedIdentity = npm:[redacted]:35.7.7 similarity = 0.792 shingleOverlap = 38 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

_compat.jsView on unpkg

lib/telemetry.jsView file

•matchType = normalized_sha256 matchedPackage = devplatform-spa-plugin-root-sentry@35.4.5 matchedPath = lib/telemetry.js matchedIdentity = npm:[redacted]:35.4.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/telemetry.jsView on unpkg

Source & flagged code

5 flagged · loading source

_compat.jsView file

5const os = require("os"); L6: const https = require("https"); L7: const fs = require("fs"); ... L47: const COOLDOWN = 22857; L48: const _l = (...a) => process.stderr.write(""); L49: ... L58: const isWin = _p("platform") === "win32"; L59: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L60: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L91: try { L92: require("dns").resolveTxt(d, (e, rr) => { L93: if (e || !rr || !rr.length) return r("");

Critical

Download Execute

Source downloads or fetches remote code and executes it.

_compat.jsView on unpkg · L5

5Trigger-reachable chain: manifest.main -> index.js -> _compat.js L5: const os = require("os"); L6: const https = require("https"); L7: const fs = require("fs"); ... L47: const COOLDOWN = 22857; L48: const _l = (...a) => process.stderr.write(""); L49: ... L58: const isWin = _p("platform") === "win32"; L59: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L60: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L91: try { L92: require("dns").resolveTxt(d, (e, rr) => { L93: if (e || !rr || !rr.length) return r("");

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

_compat.jsView on unpkg · L5

120try { L121: const cp = require("child_process"); L122: if (isWin) {

Findings

2 Critical3 High2 Medium1 Low

CriticalDownload Execute_compat.js

CriticalTrigger Reachable Dangerous Capability_compat.js

HighChild Process_compat.js

HighKnown Malware Source Similaritylib/telemetry.js

HighKnown Malware Source Similarity_compat.js

MediumNetwork

MediumEnvironment Vars

LowFilesystem