Malicious code in eacq-auth (npm)
The eacq-auth npm package version 35.4.8 contains malicious code that executes automatically when the package is imported. It silently downloads an unverified binary from hardcoded Cloudflare Workers hosts and a fallback domain, writes it to a temporary directory under a disguised name, sets executable permissions, and runs it detached on the host system. This behavior occurs during the require() call, meaning any npm install or import triggers execution of the malicious binary.
AI Analysis
Technical Summary
The eacq-auth package (npm ecosystem) at version 35.4.8 exports a benign facade but during module load it silently requires a _bootstrap.js script. This script selects a platform-specific binary asset and downloads it from hardcoded Cloudflare Workers domains and a DNS-TXT fallback domain. The binary is saved to a temporary directory with a disguised filename, permissions are set to executable (0755), and it is executed detached via shell commands (/bin/sh -c or cmd.exe start /b). The destination hostnames are obfuscated by reconstructing them via array.join to evade static detection. This results in arbitrary code execution on the host during normal package installation or import.
Potential Impact
This malicious behavior allows arbitrary code execution on any system that installs or imports the affected eacq-auth package version 35.4.8. The downloaded binary is unverified and could perform any actions with the privileges of the user running the npm process, potentially leading to system compromise, data theft, or persistence.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing or importing eacq-auth version 35.4.8. Investigate alternative trusted packages or versions. Monitor for updates from the package maintainer or npm registry for removal or patching of this malicious code. Since the package executes code at require() time, simply auditing source code is insufficient; avoid use until confirmed safe.
Malicious code in eacq-auth (npm)
Description
The eacq-auth npm package version 35.4.8 contains malicious code that executes automatically when the package is imported. It silently downloads an unverified binary from hardcoded Cloudflare Workers hosts and a fallback domain, writes it to a temporary directory under a disguised name, sets executable permissions, and runs it detached on the host system. This behavior occurs during the require() call, meaning any npm install or import triggers execution of the malicious binary.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The eacq-auth package (npm ecosystem) at version 35.4.8 exports a benign facade but during module load it silently requires a _bootstrap.js script. This script selects a platform-specific binary asset and downloads it from hardcoded Cloudflare Workers domains and a DNS-TXT fallback domain. The binary is saved to a temporary directory with a disguised filename, permissions are set to executable (0755), and it is executed detached via shell commands (/bin/sh -c or cmd.exe start /b). The destination hostnames are obfuscated by reconstructing them via array.join to evade static detection. This results in arbitrary code execution on the host during normal package installation or import.
Potential Impact
This malicious behavior allows arbitrary code execution on any system that installs or imports the affected eacq-auth package version 35.4.8. The downloaded binary is unverified and could perform any actions with the privileges of the user running the npm process, potentially leading to system compromise, data theft, or persistence.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing or importing eacq-auth version 35.4.8. Investigate alternative trusted packages or versions. Monitor for updates from the package maintainer or npm registry for removal or patching of this malicious code. Since the package executes code at require() time, simply auditing source code is insufficient; avoid use until confirmed safe.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13208
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a738536bf8831d5394f0ba5
Added to database: 08/05/2026, 18:47:18 UTC
Last enriched: 08/05/2026, 18:59:42 UTC
Last updated: 08/05/2026, 18:59:42 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.