MAL-2026-16215

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/engin1/MAL-2026-16215.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16215
Published
2026-09-16T06:31:29Z
Modified
2026-09-16T07:00:07Z
Summary
Malicious code in engin1 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (1e843727c643c5d966acaa66461f7e392813a4284cd8181b4bb9b24ddfb8447a)

The package's main entrypoint (index.js) invokes an initializer at top level that spawns loader.js as a detached background Node process on every require/import. loader.js issues an HTTPS GET to https://api.npoint.io/24c25d5f5fcbb0992a4f, base64-decodes the JSON code field, and passes the decoded string to new Function(require, __dirname, __filename, module, exports,...), executing attacker-controlled JavaScript with full Node privileges as the installing user. The endpoint URL is stored in a variable named API_KEY to disguise its nature, and the manifest/README advertise a runtime/system-info utility with a getRuntimeInfo() API that does not exist in the shipped code. The api.npoint.io document is attacker-mutable, unauthenticated, and unpinned, so whoever controls that bin controls what runs on any host importing this package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-020083",
            "import_time": "2026-09-16T06:56:08.607863721Z",
            "modified_time": "2026-09-16T06:31:29Z",
            "sha256": "1e843727c643c5d966acaa66461f7e392813a4284cd8181b4bb9b24ddfb8447a",
            "source": "amazon-inspector",
            "versions": [
                "1.3.99"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / engin1

Package

Name
engin1
View open source insights on deps.dev
Purl
pkg:npm/engin1

Affected ranges

Affected versions

1.*
1.3.99

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "loader.js",
            "sha256": "21bfaa51988b8dc7220f58d33e570d50ce43bc6103f872fda68db1eafe7729c6",
            "tlsh": "7e5121a60afb3512027770e6bb0b596a96bbe113314ec994fa9cc3d44fc2421d6d72dc"
        },
        {
            "path": "index.js",
            "sha256": "659612116d1f68484c789fe7095bb0ad7c9d0bdb5c5b10fa67e761bc286c117e",
            "tlsh": "82f0ac4b10836763855be3969652d0c00a7a8a0c3644ba02481f52bd0f940958356f53"
        },
        {
            "path": "package.json",
            "sha256": "091e2107daf39d80e08f34445a3f8faaee710c2b9601ce5e040855337e33bca1",
            "tlsh": "b301f512caa1ac9311c9ae5abd9a464761b10e434605fd093797122c4fae16f60ff66c"
        }
    ],
    "package_integrity": [
        {
            "filename": "engin1-1.3.99.tgz",
            "hashes": {
                "sha1": "8864e8d1c466f490a5e3f1e2f49158c6b31d006b",
                "sha512_sri": "sha512-jW/oKqEnJehcMW0Qq2VguD8qnkWaXKKIPEv9SePhnaSLjQEIiN/M1vUSluqASyQA927RrmHeeuB5HyJYCJ2eIQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/engin1/MAL-2026-16215.json"