🛡️ MAL-2026-13515 — eacq-dialog

Malicious code in eacq-dialog (npm)

Source: amazon-inspector

[email protected] contains a dropper reachable both from setup.js and from the main-exported lib/telemetry.js (loaded on require('eacq-dialog')). The code downloads a platform-specific binary from hardcoded Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT fallback channel using sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, writes the payload to /var/tmp or %TEMP% under a disguised name (.cache_<hex> or dotnet_diag_<hex>.exe), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. Hostnames and sensitive Node APIs (child_process, chmodSync) are reassembled from split string fragments (e.g. ['oob-worke','r.cf99-9b3.worker','s.','dev'].join(''), require('child_'+'process')) to evade static scanners. No hash or signature verification is performed; the destinations are not the package publisher and do not match the package's stated 'infrastructure utilities' purpose. lib/telemetry.js duplicates the fetch/chmod/spawn primitives (Buffer.from(chunks,'base64'), fs['chmod'+'Sync'](path, mode | parseInt('755',8)), cp.spawn('/bin/sh',['-c',filePath+' &'])), so the payload executes on every require of the package independently of setup.js.