The eacq-acq-menu-core npm package (version 35.9.7) includes a malicious dropper that dynamically reconstructs C2 hostnames from fragmented string arrays to evade static detection. It downloads platform-specific executable payloads via HTTPS and, if unsuccessful, uses a covert DNS TXT record transport mechanism to retrieve base64-encoded payload chunks, which are concatenated and decoded into an executable. The payload is saved to temporary directories with disguised filenames, permissions are set to executable, and the binary is launched detached from the main process. The package's documentation misrepresents its functionality as a benign framework module, concealing its true malicious intent.

This malicious package enables remote attackers to deliver and execute arbitrary binaries on affected systems, potentially leading to unauthorized code execution and system compromise. The use of covert DNS TXT record transport for payload delivery complicates detection and analysis. There is no evidence of active exploitation in the wild as of the provided data.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove the eacq-acq-menu-core package version 35.9.7 from their environments and avoid installing it. Employ supply chain security measures such as verifying package integrity and source reputation before installation. Monitor for any unexpected execution of binaries from temporary directories and investigate accordingly. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.