The eacq-cdk npm package version 35.8.1 includes a malicious loader (_init.js) that triggers on package import. It constructs obfuscated Cloudflare Workers hostnames to fetch an executable payload over HTTPS. If HTTPS retrieval fails, it falls back to retrieving a base64-encoded payload via DNS TXT queries from *.dl.wel1.ru. The payload is saved to a hidden file in the system's temporary directory, permissions are set to executable (chmod 0755), and it is spawned detached using shell commands (/bin/sh or cmd). This grants the remote operator full code execution on the host system. The domains used are unrelated to any legitimate publisher and are obfuscated to evade detection. The package masquerades this behavior as telemetry or analytics but is in fact malicious.

Any project that installs and requires eacq-cdk version 35.8.1 implicitly grants full code execution privileges to the remote operator controlling the payload delivery endpoints. This can lead to complete system compromise, unauthorized code execution, and potential further malicious activity on the affected host.

No official patch or remediation is currently documented. Users should immediately avoid installing or requiring eacq-cdk version 35.8.1. Remove the package from all projects and replace it with a trusted alternative. Monitor for any signs of compromise on systems where this package was used. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.