eacq-auth@35.4.8: Malicious npm security report (Block)

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing eacq-auth triggers a background downloader. It retrieves an unverified platform payload, writes it to a temporary directory, and executes it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of the package entrypoint.

Impact

Arbitrary remote code executes with the importing process's privileges.

Mechanism

Import-time remote binary download and detached execution.

Attack narrative

Loading index.js silently requires _bootstrap.js. Its init routine contacts hard-coded worker mirrors for a platform-specific binary, or reconstructs one from DNS TXT records. It writes the received bytes to a temporary executable path, sets executable permissions on non-Windows systems, and launches it detached through a shell or cmd.exe.

Rationale

The package’s advertised authentication API has no legitimate need for an import-time, unverified remote binary downloader and detached executor. This is a concrete arbitrary-code execution chain.

Evidence

package.jsonindex.js_bootstrap.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>

Network endpoints7

oob-worker.cf103-070.workers.dev/pkg/packageoob-worker.cf99-9b3.workers.dev/pkg/packageoob-worker.cf102-baf.workers.dev/pkg/packagesdk.dl.wel1.ruext.dl.wel1.rupkg.dl.wel1.ru

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-13208

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in eacq-auth (npm)

Details

index.js exports a benign TokenManager facade but silently `require('./_bootstrap')` in a try/catch on load. _bootstrap.js selects a platform-specific asset, downloads an unverified binary from hardcoded Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev) — with a DNS-TXT chunked-fetch fallback under *.dl.wel1.ru — writes it to /tmp or %TEMP% under a disguised name (e.g. dotnet_diag_,.cache_), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe start /b. Destination hostnames are reconstructed by array.join to evade static string matching. Executes at require() time, so a normal `npm install` + any downstream import runs the fetched binary on the installer host.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.js imports _bootstrap.js on every package import.
_bootstrap.js downloads platform binaries from hard-coded worker hosts.
It falls back to DNS TXT payload retrieval from wel1.ru hosts.
Downloaded data is written to /var/tmp or Windows Temp, chmodded, then detached-spawned.
Execution is concealed with empty logging and broad error suppression.

Evidence against

package.json has no lifecycle scripts.
No credential or project-file harvesting was found in inspected source.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 85.1 KB of source

Source & flagged code

4 flagged

_bootstrap.jsView file

3const path = require("path"); L4: const https = require("https"); L5: const fs = require("fs"); ... L46: const TTL = 22961; L47: const _l = (...a) => process.stderr.write(""); L48: ... L57: const isWin = _p("platform") === "win32"; L58: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L59: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L93: try { L94: require("dns").resolveTxt(d, (e, rr) => { L95: if (e || !rr || !rr.length) return r("");

Critical

Download Execute

Source downloads or fetches remote code and executes it.

_bootstrap.jsView on unpkg · L3

3Trigger-reachable chain: manifest.main -> index.js -> _bootstrap.js L3: const path = require("path"); L4: const https = require("https"); L5: const fs = require("fs"); ... L46: const TTL = 22961; L47: const _l = (...a) => process.stderr.write(""); L48: ... L57: const isWin = _p("platform") === "win32"; L58: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L59: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L93: try { L94: require("dns").resolveTxt(d, (e, rr) => { L95: if (e || !rr || !rr.length) return r("");

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

_bootstrap.jsView on unpkg · L3

120try { L121: const cp = require("child_process"); L122: if (isWin) {

High

Child Process

Package source references child process execution.

_bootstrap.jsView on unpkg · L120

•matchType = token_shingles matchedPackage = checkout-confirm-pos-order-sms-am@35.6.4 matchedPath = _init.js matchedIdentity = npm:[redacted]:35.6.4 similarity = 0.854 shingleOverlap = 41 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

_bootstrap.jsView on unpkg

Source & flagged code

4 flagged · loading source

_bootstrap.jsView file

3const path = require("path"); L4: const https = require("https"); L5: const fs = require("fs"); ... L46: const TTL = 22961; L47: const _l = (...a) => process.stderr.write(""); L48: ... L57: const isWin = _p("platform") === "win32"; L58: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L59: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L93: try { L94: require("dns").resolveTxt(d, (e, rr) => { L95: if (e || !rr || !rr.length) return r("");

Critical

Download Execute

Source downloads or fetches remote code and executes it.

_bootstrap.jsView on unpkg · L3

3Trigger-reachable chain: manifest.main -> index.js -> _bootstrap.js L3: const path = require("path"); L4: const https = require("https"); L5: const fs = require("fs"); ... L46: const TTL = 22961; L47: const _l = (...a) => process.stderr.write(""); L48: ... L57: const isWin = _p("platform") === "win32"; L58: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L59: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L93: try { L94: require("dns").resolveTxt(d, (e, rr) => { L95: if (e || !rr || !rr.length) return r("");

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

_bootstrap.jsView on unpkg · L3

Findings

2 Critical2 High3 Medium2 Low

CriticalDownload Execute_bootstrap.js

CriticalTrigger Reachable Dangerous Capability_bootstrap.js

HighChild Process_bootstrap.js

HighKnown Malware Source Similarity_bootstrap.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings