Importing the package triggers a hidden remote binary loader. It fetches platform-specific bytes, drops them in a temp directory, and runs them detached.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Any runtime require/import of eacq-payform-core.
Impact
Arbitrary attacker-controlled native code executes under the importing process's user account.
Mechanism
Obfuscated remote binary download, temp-file drop, chmod, and detached shell execution.
Attack narrative
On normal module import, index.js loads _vendor.js, which runs setup(). The loader contacts obfuscated worker hosts for platform-specific binary content, with DNS TXT chunk retrieval as fallback. It writes sufficient-size content to a disguised temporary executable, makes it executable on Unix, and launches it detached through /bin/sh or cmd.exe. This is a concrete remote-code-execution loader, not package-aligned telemetry.
Rationale
The malicious loader is reachable at import time and executes unverified remote bytes. No lifecycle hook is required for the attack to affect package consumers.
Evidence
package.jsonindex.js_vendor.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%/analytics_state%TEMP%/dotnet_diag_<random>.exe
Network endpoints8
oob-worker.cf102-baf.workers.dev/pkg/package