{"id":"MAL-2026-13206","summary":"Malicious code in eacq-acq-menu-core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (daaba295870311c8170bc4ec82050e0f4ba2989be2b3e10de136647fc18ea6fc)\nOn require(), index.js loads _helpers.js which reconstructs C2 hostnames from split-string arrays (e.g., 'oob-worker.cf*.workers.dev' and 'sdk.dl.wel1.ru') and downloads a platform-specific binary via https.get. The binary is written to /tmp or %TEMP% under a disguised name (dotnet_diag_\u003chex\u003e.exe,.cache_\u003chex\u003e), chmodded 0o755 on Unix, and spawned detached via cmd.exe/start or /bin/sh -c with the '&' background operator. When HTTPS delivery fails, a fallback path queries DNS TXT records at c.\u003cdomain\u003e and numbered subdomains under dl.wel1.ru, concatenates the returned chunks, base64-decodes them, and writes the result as the executable payload — a covert DNS-TXT transport for payload delivery. Hostnames are fragmented across arrays and joined at runtime specifically to evade static string search, with cover-story comments ('Retry with exponential backoff', 'DNS-based discovery') inserted around the dropper logic. The package's README presents it as a benign 'base framework module', which does not match the shipped behavior.\n","modified":"2026-08-05T15:53:12.238350465Z","published":"2026-08-05T15:06:37Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["35.9.7"],"id":"IN-MAL-2026-015570","import_time":"2026-08-05T15:19:58.406520551Z","modified_time":"2026-08-05T15:06:37Z","sha256":"daaba295870311c8170bc4ec82050e0f4ba2989be2b3e10de136647fc18ea6fc"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/eacq-acq-menu-core/v/35.9.7"}],"affected":[{"package":{"name":"eacq-acq-menu-core","ecosystem":"npm","purl":"pkg:npm/eacq-acq-menu-core"},"versions":["35.9.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"hashes":{"sha512_sri":"sha512-zIVxxXHrNhf20aB+Csl9dV/tIwIKawk1u26nA+8EHmTnlo8mj/cwJzyd0rAY6toV9ivuhtAn17CwjyX41sTE7w==","sha1":"77dbfc57edc4a49ad2f02e4a21f1cc2ae705c208"},"filename":"eacq-acq-menu-core-35.9.7.tgz"}],"evidence_files":[{"path":"_helpers.js","sha256":"6ae7f393c8b43fbfcdc9042790361c899dc08d59cd979668a86c8e21fb7ce2c0","tlsh":"19a185aa16a670188bb097e1c7175416f65af5637780c1d8fb9ca5881ff312483b2efc"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/eacq-acq-menu-core/MAL-2026-13206.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}