MAL-2026-13513 Malicious code in eacq-cdk (npm)
Malicious package
Published
MAL-2026-13513 is a malicious package: eacq-cdk (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-13513/ (Markdown: https://insights.sbomify.com/MAL-2026-13513/index.md)
- Package
- eacq-cdk
- Registry
- npm
What is MAL-2026-13513?
MAL-2026-13513 is a malicious package in eacq-cdk, published on 7 Aug 2026.
Official description
Requiring the package executes _init.js, which selects a platform-specific payload path and fetches an executable over HTTPS from Cloudflare Workers hosts whose names are assembled via.join('') from character-shard arrays (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev). If HTTPS retrieval fails, the loader falls back to base64-encoded payload delivery over DNS TXT queries under *.dl.wel1.ru. The fetched bytes are written to a hidden filename under /tmp (or Windows Temp), chmod 0755'd, and spawned detached via spawn('/bin/sh',…) / spawn('cmd',…). The destinations are unrelated to any legitimate publisher, the hostnames are split across arrays to defeat static string search, and the behavior is framed as 'telemetry/analytics'. Any project that installs this package hands full-host code execution to the operator of those endpoints on first require.
What should I do about MAL-2026-13513?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.