{"id":"MAL-2026-16076","summary":"Malicious code in external_deps_enjoyer (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8d4909b60251f0448ff7bc689262f363e3ec4c2cebf82abe3eb0c7f8769931a6)\npackage.json declares dependencies and optionalDependencies whose specifiers point at non-registry, attacker-controlled or mutable sources rather than the npm registry. Listed sources include a Discord CDN attachment tarball (cdn.discordapp.com/attachments/.../runtime.tgz), plain-HTTP tarballs at bare IPs (http://203.0.113.77:8443/drop/pkg.tgz, HTTP://198.51.100.44/.../pkg.tgz), git://203.0.113.91/hidden/repo.git, an ngrok tunnel (abc123xyz.ngrok-free.app), rentry.co raw content, gist shorthands (gist:c0ffee00deadbeef), and github/gitlab/bitbucket shorthands to throwaway repos (tmp-drop-8821/...). Specifier keys are duplicated with case variants (tarball-http vs tarball-HTTP, github-shorthand vs GITHUB-shorthand) and mix uppercase URI schemes with scp-style git refs and local path forms (link:, portal:, file:, /tmp/..., \\Windows\\Temp\\...), a pattern engineered to evade regex-based scanners. On npm install, npm fetches each specifier and executes any lifecycle scripts the fetched package declares; because the sources are mutable and controlled by third parties, the code that runs is whatever the operators of those hosts currently serve.\n","modified":"2026-09-09T05:45:04.561804238Z","published":"2026-09-09T05:34:09Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-019846","import_time":"2026-09-09T05:40:09.278621586Z","modified_time":"2026-09-09T05:34:09Z","sha256":"8d4909b60251f0448ff7bc689262f363e3ec4c2cebf82abe3eb0c7f8769931a6"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/external_deps_enjoyer/v/1.0.0"}],"affected":[{"package":{"name":"external_deps_enjoyer","ecosystem":"npm","purl":"pkg:npm/external_deps_enjoyer"},"versions":["1.0.0"],"database_specific":{"indicators":{"evidence_files":[{"tlsh":"f6610ea6d9050c778b6d04e6dc66960af902a60f4fc0b8607b81566fdf0c52f70fda6c","path":"package.json","sha256":"9da96b6e0424bf25941b9d38148302178a20e80dc84cca66a6fa75c7518bd54b"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-VB9POsl7vz3IBR/Xisuqac2akJ32OrDlKRUoYYBYiAbqnUG58qIbqptj84zAqIxHtyK8NxCdIjW8Ngy3VdcmPQ==","sha1":"030acff11aee1f4196aee8a7122bb22b5e71041f"},"filename":"external_deps_enjoyer-1.0.0.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/external_deps_enjoyer/MAL-2026-16076.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}]}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}