eacq-api @35.6.1

Summary

On require() of eacq-api, index.js loads _compat.js which reconstructs C2 hostnames from string-split fragments (oob-worker.cf10{0,1,2,3}-*.workers.dev) and a DNS TXT chunked-base64 fallback channel over *.dl.wel1.ru subdomains (sdk/ext/pkg/net). getBinary() downloads a platform-specific opaque binary over HTTPS (or via the DNS TXT fallback), writes it to a disguised path under /tmp or %TEMP% such as dotnet_diag_<hex>.exe or.cache_<hex>, chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe. Execution is gated only by a filesystem cooldown marker and env opt-out flags; there is no hash or signature verification of the fetched bytes despite a comment claiming SHA-256 checking. The delivery infrastructure (anonymous Cloudflare Workers hosts + a DNS TXT covert channel) is unrelated to any legitimate API-client purpose, and the endpoint reconstruction plus alternate DNS transport indicate deliberate evasion of static scanners.

Source: amazon-inspector (1f72372a4c98fc1b4f187839fabe1a0bf8f7d98c8250c06baebf129920474332)