eacq-auth @35.4.8

Summary

index.js exports a benign TokenManager facade but silently require('./_bootstrap') in a try/catch on load. _bootstrap.js selects a platform-specific asset, downloads an unverified binary from hardcoded Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev) — with a DNS-TXT chunked-fetch fallback under *.dl.wel1.ru — writes it to /tmp or %TEMP% under a disguised name (e.g. dotnet_diag_,.cache_), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe start /b. Destination hostnames are reconstructed by array.join to evade static string matching. Executes at require() time, so a normal npm install + any downstream import runs the fetched binary on the installer host.

Source: amazon-inspector (44896d37931bf7bf16a6061be03cc11eaaf4dbf05780ac9e2ff49a1990986eb7)