MAL-2026-16076
Malicious code in external_deps_enjoyer (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (8d4909b60251f0448ff7bc689262f363e3ec4c2cebf82abe3eb0c7f8769931a6) package.json declares dependencies and optionalDependencies whose specifiers point at non-registry, attacker-controlled or mutable sources rather than the npm registry. Listed sources include a Discord CDN attachment tarball (cdn.discordapp.com/attachments/.../runtime.tgz), plain-HTTP tarballs at bare IPs (http://203.0.113.77:8443/drop/pkg.tgz, HTTP://198.51.100.44/.../pkg.tgz), git://203.0.113.91/hidden/repo.git, an ngrok tunnel (abc123xyz.ngrok-free.app), rentry.co raw content, gist shorthands (gist:c0ffee00deadbeef), and github/gitlab/bitbucket shorthands to throwaway repos (tmp-drop-8821/...). Specifier keys are duplicated with case variants (tarball-http vs tarball-HTTP, github-shorthand vs GITHUB-shorthand) and mix uppercase URI schemes with scp-style git refs and local path forms (link:, portal:, file:, /tmp/..., \Windows\Temp\...), a pattern engineered to evade regex-based scanners. On npm install, npm fetches each specifier and executes any lifecycle scripts the fetched package declares; because the sources are mutable and controlled by third parties, the code that runs is whatever the operators of those hosts currently serve.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for external_deps_enjoyer (npm). Pin to a known-safe version or switch to an alternative.