eacq-dialog

{"modified":"2026-08-07T12:11:57Z","published":"2026-08-07T12:11:57Z","schema_version":"1.7.4","id":"MAL-2026-13515","summary":"Malicious code in eacq-dialog (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (af2bcb4382f02a977f8448ea4f0172253035755b2d1dc363cce80f0389a1ee70)\neacq-dialog@35.8.1 contains a dropper reachable both from setup.js and from the main-exported lib/telemetry.js (loaded on require('eacq-dialog')). The code downloads a platform-specific binary from hardcoded Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT fallback channel using sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, writes the payload to /var/tmp or %TEMP% under a disguised name (.cache_<hex> or dotnet_diag_<hex>.exe), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. Hostnames and sensitive Node APIs (child_process, chmodSync) are reassembled from split string fragments (e.g. ['oob-worke','r.cf99-9b3.worker','s.','dev'].join(''), require('child_'+'process')) to evade static scanners. No hash or signature verification is performed; the destinations are not the package publisher and do not match the package's stated 'infrastructure utilities' purpose. lib/telemetry.js duplicates the fetch/chmod/spawn primitives (Buffer.from(chunks,'base64'), fs['chmod'+'Sync'](path, mode | parseInt('755',8)), cp.spawn('/bin/sh',['-c',filePath+' &'])), so the payload executes on every require of the package independently of setup.js.\n","affected":[{"package":{"ecosystem":"npm","name":"eacq-dialog"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.js","sha256":"9083275a27a26a2b6ad45671818198a1f0d490334e5e81f13fa9a626f7bbf679","tlsh":"71a1b85a16fa30280292e1d8852f581ab19bf69333c4d9c4fb0ca6944f9b16843b3dfc"},{"path":"lib/telemetry.js","sha256":"53b6af71a86a17ed94b6f3b25e6843f61f2bf3454995707135800f7625a444b2","tlsh":"9173304966fb10214263b0685fbb40437635c4072a4aed5dba9c43ec9f8db3896f1fb9"}],"package_integrity":[{"filename":"eacq-dialog-35.8.1.tgz","hashes":{"sha1":"1d084e84daebdd5a1f4150bddeb3e6d2edc5692e","sha512_sri":"sha512-rs6/6FLSkYifS7q8/OYhbNZjOdrUUjmLSRLom9OPY75w/qvuF3QjYeabXWoQwe7HTIlPdvaPWO0WTBDWtole4w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/eacq-dialog/v/35.8.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016879","import_time":"2026-08-07T12:23:25.480274432Z","modified_time":"2026-08-07T12:11:57Z","sha256":"af2bcb4382f02a977f8448ea4f0172253035755b2d1dc363cce80f0389a1ee70","source":"amazon-inspector","versions":["35.8.1"]}]}}