The npm package 'eacq-acq-menu' version 35.2.1 is a malicious package that, upon being required, executes a setup routine which downloads and runs a platform-specific binary from obfuscated external hosts. It disguises the binary with cover-story filenames in temporary directories and executes it detached from the main process. The package falsely advertises itself as a menu-provider library but performs no legitimate function other than delivering and executing opaque remote code on the host system.