The eacq-core npm package version 35.8.1 includes code in _helpers.js and lib/telemetry.js that dynamically constructs URLs to download platform-specific binaries from Cloudflare Workers hosts and a fallback DNS-TXT domain. These binaries are saved to temporary directories with executable permissions and launched detached via shell commands. The code uses string concatenation and obfuscation techniques to evade static analysis. No integrity checks such as hash or signature verification are performed on the downloaded binaries. This fetch-and-execute behavior triggers unconditionally when the module is loaded, allowing whoever controls the remote hosts to execute arbitrary code on the host system.

Any system that installs or imports eacq-core version 35.8.1 is at risk of arbitrary code execution by a remote attacker controlling the Cloudflare Workers hosts or fallback domains. This can lead to full system compromise, data theft, or further malware deployment. The lack of verification on the downloaded binaries and unconditional execution significantly increases the severity of this threat.

No official patch or remediation is currently available. Users should immediately avoid installing or importing eacq-core version 35.8.1. Remove the package from any affected systems. Monitor for updates from the package maintainers or npm registry for a fixed version. Consider using alternative trusted packages and verify package integrity before installation.