The npm package eacq-dialog version 35.8.1 contains malicious code that downloads and executes a platform-specific binary from hardcoded external hosts. The payload is saved under disguised filenames in temporary directories, given executable permissions, and launched detached from the Node.js process. The malicious code is triggered both during setup and on every require of the package, using obfuscated string assembly to evade static detection. No integrity checks are performed on the downloaded payload, and the external hosts are unrelated to the package's stated purpose.