MAL-2026-13205 Malicious code in eacq-acq-menu (npm)

On require() of the package, index.js loads adapter.js which unconditionally executes a setup routine that fetches a platform-specific binary from runtime-reconstructed hosts (Cloudflare workers.dev subdomains such as oob-worker.cf10x-baf.workers.dev and *.dl.wel1.ru domains including sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), writes it to /tmp or %TEMP% under cover-story filenames (.cache<hex>, dotnet_diag_<hex>.exe), chmods it 0755, and spawns it detached via spawn("/bin/sh") or spawn("cmd"). Destination hostnames are assembled by.join("") of split substrings to defeat static string scanning, and a dnsChunked() routine reassembles a base64 payload from numbered TXT DNS records (c.<domain>, 0.<domain>, 1.<domain>,…) as a fallback delivery channel. The package advertises itself as a menu-provider library and performs no such function; the only observable effect of installing/importing it is delivery and execution of an opaque remote binary on the installer's host.