The eacq-dialog npm package version 35.8.1 includes a dropper component accessible from setup.js and the main exported telemetry.js module. This dropper downloads a platform-specific binary from multiple hardcoded Cloudflare Workers domains and fallback DNS-TXT channels pointing to unrelated Russian domains. The binary is saved to /var/tmp or %TEMP% with disguised names such as .cache_<hex> or dotnet_diag_<hex>.exe, permissions are set to 0755, and the binary is spawned detached using shell commands. The code uses string fragment concatenation to hide hostnames and sensitive Node.js APIs like child_process and chmodSync from static scanners. The telemetry.js module duplicates the download, permission change, and spawn logic, causing the payload to execute on every require of the package. No hash or signature verification is performed on the downloaded payload, and the external hosts do not belong to the package publisher or align with the package's declared functionality.

This malicious behavior results in arbitrary code execution on any system that installs and requires the affected eacq-dialog package version 35.8.1. The dropped binary runs detached from the Node.js process, potentially allowing persistent unauthorized actions. The lack of integrity verification and use of unrelated external hosts indicate a high risk of compromise and potential further malicious activity on affected systems.

No official patch or remediation guidance is currently available for this malicious package version. Users should immediately remove eacq-dialog version 35.8.1 from their environments and avoid installing this version. It is recommended to verify package integrity before installation and prefer trusted package sources. Monitor for updates or advisories from the package publisher or npm registry regarding this issue.