MAL-2026-16076

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/external_deps_enjoyer/MAL-2026-16076.json

JSON Data

https://api.test.osv.dev/v1/vulns/MAL-2026-16076

Published

2026-09-09T05:34:09Z

Modified

2026-09-09T05:45:04Z

Summary

Malicious code in external_deps_enjoyer (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8d4909b60251f0448ff7bc689262f363e3ec4c2cebf82abe3eb0c7f8769931a6)

package.json declares dependencies and optionalDependencies whose specifiers point at non-registry, attacker-controlled or mutable sources rather than the npm registry. Listed sources include a Discord CDN attachment tarball (cdn.discordapp.com/attachments/.../runtime.tgz), plain-HTTP tarballs at bare IPs (http://203.0.113.77:8443/drop/pkg.tgz, HTTP://198.51.100.44/.../pkg.tgz), git://203.0.113.91/hidden/repo.git, an ngrok tunnel (abc123xyz.ngrok-free.app), rentry.co raw content, gist shorthands (gist:c0ffee00deadbeef), and github/gitlab/bitbucket shorthands to throwaway repos (tmp-drop-8821/...). Specifier keys are duplicated with case variants (tarball-http vs tarball-HTTP, github-shorthand vs GITHUB-shorthand) and mix uppercase URI schemes with scp-style git refs and local path forms (link:, portal:, file:, /tmp/..., \Windows\Temp...), a pattern engineered to evade regex-based scanners. On npm install, npm fetches each specifier and executes any lifecycle scripts the fetched package declares; because the sources are mutable and controlled by third parties, the code that runs is whatever the operators of those hosts currently serve.

Database specific

{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-019846",
            "import_time": "2026-09-09T05:40:09.278621586Z",
            "modified_time": "2026-09-09T05:34:09Z",
            "sha256": "8d4909b60251f0448ff7bc689262f363e3ec4c2cebf82abe3eb0c7f8769931a6",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}

References

https://www.npmjs.com/package/external_deps_enjoyer/v/1.0.0

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / external_deps_enjoyer

Package

Name: external_deps_enjoyer; View open source insights on deps.dev
Purl: pkg:npm/external_deps_enjoyer

Affected ranges

Affected versions

1.*

1.0.0

Database specific

cwes

[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]

indicators

{
    "evidence_files": [
        {
            "path": "package.json",
            "sha256": "9da96b6e0424bf25941b9d38148302178a20e80dc84cca66a6fa75c7518bd54b",
            "tlsh": "f6610ea6d9050c778b6d04e6dc66960af902a60f4fc0b8607b81566fdf0c52f70fda6c"
        }
    ],
    "package_integrity": [
        {
            "filename": "external_deps_enjoyer-1.0.0.tgz",
            "hashes": {
                "sha1": "030acff11aee1f4196aee8a7122bb22b5e71041f",
                "sha512_sri": "sha512-VB9POsl7vz3IBR/Xisuqac2akJ32OrDlKRUoYYBYiAbqnUG58qIbqptj84zAqIxHtyK8NxCdIjW8Ngy3VdcmPQ=="
            }
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/external_deps_enjoyer/MAL-2026-16076.json"