The npm package eacq-core version 35.8.1 contains malicious code that downloads and executes platform-specific binaries from suspicious Cloudflare Workers hosts and fallback domains. This occurs immediately upon module load without any verification, enabling arbitrary code execution on any machine that installs or imports the package. The malicious payload is obfuscated to evade detection and masquerades as an analytics SDK.