Malicious code in eacq-api (npm)
The eacq-api npm package version 35.6.1 contains malicious code that downloads and executes a platform-specific binary from covert command-and-control infrastructure. The code reconstructs C2 hostnames and uses a DNS TXT fallback channel to evade detection. The downloaded binary is saved to a disguised temporary path, made executable, and run without any cryptographic verification. This behavior is unrelated to legitimate functionality and indicates deliberate evasion techniques.
AI Analysis
Technical Summary
The eacq-api package (version 35.6.1) includes malicious code that, upon require(), loads a script which reconstructs command-and-control hostnames using fragmented strings and a DNS TXT chunked-base64 fallback channel. It downloads a platform-specific opaque binary over HTTPS or DNS TXT records, writes it to a disguised temporary file path, sets executable permissions, and spawns it detached via shell commands. Execution is controlled only by a filesystem cooldown marker and environment opt-out flags, with no hash or signature verification despite comments claiming SHA-256 checks. The delivery infrastructure uses anonymous Cloudflare Workers and DNS TXT covert channels, indicating deliberate evasion of static scanners and unrelated to any legitimate API-client purpose.
Potential Impact
This malicious behavior allows remote code execution of an opaque binary on the host system where the eacq-api package is installed. The lack of integrity verification and use of covert channels for binary delivery increases the risk of undetected compromise. The execution of arbitrary code can lead to full system compromise, data theft, or further malware deployment.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately remove version 35.6.1 of the eacq-api package from their environments. Avoid installing or using this package until a trusted, verified version is available. Monitor for any signs of compromise on systems where this package was installed. Patch status is not yet confirmed — check the vendor advisory or trusted sources for current remediation guidance.
Malicious code in eacq-api (npm)
Description
The eacq-api npm package version 35.6.1 contains malicious code that downloads and executes a platform-specific binary from covert command-and-control infrastructure. The code reconstructs C2 hostnames and uses a DNS TXT fallback channel to evade detection. The downloaded binary is saved to a disguised temporary path, made executable, and run without any cryptographic verification. This behavior is unrelated to legitimate functionality and indicates deliberate evasion techniques.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The eacq-api package (version 35.6.1) includes malicious code that, upon require(), loads a script which reconstructs command-and-control hostnames using fragmented strings and a DNS TXT chunked-base64 fallback channel. It downloads a platform-specific opaque binary over HTTPS or DNS TXT records, writes it to a disguised temporary file path, sets executable permissions, and spawns it detached via shell commands. Execution is controlled only by a filesystem cooldown marker and environment opt-out flags, with no hash or signature verification despite comments claiming SHA-256 checks. The delivery infrastructure uses anonymous Cloudflare Workers and DNS TXT covert channels, indicating deliberate evasion of static scanners and unrelated to any legitimate API-client purpose.
Potential Impact
This malicious behavior allows remote code execution of an opaque binary on the host system where the eacq-api package is installed. The lack of integrity verification and use of covert channels for binary delivery increases the risk of undetected compromise. The execution of arbitrary code can lead to full system compromise, data theft, or further malware deployment.
Defensive Guidance
No official patch or remediation is currently documented. Users should immediately remove version 35.6.1 of the eacq-api package from their environments. Avoid installing or using this package until a trusted, verified version is available. Monitor for any signs of compromise on systems where this package was installed. Patch status is not yet confirmed — check the vendor advisory or trusted sources for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13207
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a738536bf8831d5394f0ba2
Added to database: 08/05/2026, 18:47:18 UTC
Last enriched: 08/05/2026, 18:59:51 UTC
Last updated: 08/05/2026, 21:54:41 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.