MAL-2026-13206 Malicious code in eacq-acq-menu-core (npm)

On require(), index.js loads helpers.js which reconstructs C2 hostnames from split-string arrays (e.g., 'oob-worker.cf*.workers.dev' and 'sdk.dl.wel1.ru') and downloads a platform-specific binary via https.get. The binary is written to /tmp or %TEMP% under a disguised name (dotnet_diag<hex>.exe,.cache_<hex>), chmodded 0o755 on Unix, and spawned detached via cmd.exe/start or /bin/sh -c with the '&' background operator. When HTTPS delivery fails, a fallback path queries DNS TXT records at c.<domain> and numbered subdomains under dl.wel1.ru, concatenates the returned chunks, base64-decodes them, and writes the result as the executable payload — a covert DNS-TXT transport for payload delivery. Hostnames are fragmented across arrays and joined at runtime specifically to evade static string search, with cover-story comments ('Retry with exponential backoff', 'DNS-based discovery') inserted around the dropper logic. The package's README presents it as a benign 'base framework module', which does not match the shipped behavior.