MAL-2026-13515

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/eacq-dialog/MAL-2026-13515.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13515
Published
2026-08-07T12:11:57Z
Modified
2026-08-07T12:35:17.987336527Z
Summary
Malicious code in eacq-dialog (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (af2bcb4382f02a977f8448ea4f0172253035755b2d1dc363cce80f0389a1ee70)

eacq-dialog@35.8.1 contains a dropper reachable both from setup.js and from the main-exported lib/telemetry.js (loaded on require('eacq-dialog')). The code downloads a platform-specific binary from hardcoded Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT fallback channel using sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, writes the payload to /var/tmp or %TEMP% under a disguised name (.cache<hex> or dotnetdiag<hex>.exe), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. Hostnames and sensitive Node APIs (childprocess, chmodSync) are reassembled from split string fragments (e.g. ['oob-worke','r.cf99-9b3.worker','s.','dev'].join(''), require('child_'+'process')) to evade static scanners. No hash or signature verification is performed; the destinations are not the package publisher and do not match the package's stated 'infrastructure utilities' purpose. lib/telemetry.js duplicates the fetch/chmod/spawn primitives (Buffer.from(chunks,'base64'), fs'chmod'+'Sync', cp.spawn('/bin/sh',['-c',filePath+' &'])), so the payload executes on every require of the package independently of setup.js.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-07T12:11:57Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-016879",
            "import_time": "2026-08-07T12:23:25.480274432Z",
            "sha256": "af2bcb4382f02a977f8448ea4f0172253035755b2d1dc363cce80f0389a1ee70",
            "versions": [
                "35.8.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / eacq-dialog

Package

Name
eacq-dialog
View open source insights on deps.dev
Purl
pkg:npm/eacq-dialog

Affected ranges

Affected versions

35.*
35.8.1

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "eacq-dialog-35.8.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-rs6/6FLSkYifS7q8/OYhbNZjOdrUUjmLSRLom9OPY75w/qvuF3QjYeabXWoQwe7HTIlPdvaPWO0WTBDWtole4w==",
                "sha1": "1d084e84daebdd5a1f4150bddeb3e6d2edc5692e"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "71a1b85a16fa30280292e1d8852f581ab19bf69333c4d9c4fb0ca6944f9b16843b3dfc",
            "sha256": "9083275a27a26a2b6ad45671818198a1f0d490334e5e81f13fa9a626f7bbf679",
            "path": "setup.js"
        },
        {
            "tlsh": "9173304966fb10214263b0685fbb40437635c4072a4aed5dba9c43ec9f8db3896f1fb9",
            "sha256": "53b6af71a86a17ed94b6f3b25e6843f61f2bf3454995707135800f7625a444b2",
            "path": "lib/telemetry.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/eacq-dialog/MAL-2026-13515.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]