engin1

{"modified":"2026-09-16T06:31:29Z","published":"2026-09-16T06:31:29Z","schema_version":"1.7.4","id":"MAL-2026-16215","summary":"Malicious code in engin1 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1e843727c643c5d966acaa66461f7e392813a4284cd8181b4bb9b24ddfb8447a)\nThe package's main entrypoint (index.js) invokes an initializer at top level that spawns loader.js as a detached background Node process on every require/import. loader.js issues an HTTPS GET to https://api.npoint.io/24c25d5f5fcbb0992a4f, base64-decodes the JSON `code` field, and passes the decoded string to `new Function(require, __dirname, __filename, module, exports,...)`, executing attacker-controlled JavaScript with full Node privileges as the installing user. The endpoint URL is stored in a variable named `API_KEY` to disguise its nature, and the manifest/README advertise a runtime/system-info utility with a `getRuntimeInfo()` API that does not exist in the shipped code. The api.npoint.io document is attacker-mutable, unauthenticated, and unpinned, so whoever controls that bin controls what runs on any host importing this package.\n","affected":[{"package":{"ecosystem":"npm","name":"engin1"},"versions":["1.3.99"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"loader.js","sha256":"21bfaa51988b8dc7220f58d33e570d50ce43bc6103f872fda68db1eafe7729c6","tlsh":"7e5121a60afb3512027770e6bb0b596a96bbe113314ec994fa9cc3d44fc2421d6d72dc"},{"path":"index.js","sha256":"659612116d1f68484c789fe7095bb0ad7c9d0bdb5c5b10fa67e761bc286c117e","tlsh":"82f0ac4b10836763855be3969652d0c00a7a8a0c3644ba02481f52bd0f940958356f53"},{"path":"package.json","sha256":"091e2107daf39d80e08f34445a3f8faaee710c2b9601ce5e040855337e33bca1","tlsh":"b301f512caa1ac9311c9ae5abd9a464761b10e434605fd093797122c4fae16f60ff66c"}],"package_integrity":[{"filename":"engin1-1.3.99.tgz","hashes":{"sha1":"8864e8d1c466f490a5e3f1e2f49158c6b31d006b","sha512_sri":"sha512-jW/oKqEnJehcMW0Qq2VguD8qnkWaXKKIPEv9SePhnaSLjQEIiN/M1vUSluqASyQA927RrmHeeuB5HyJYCJ2eIQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/engin1/v/1.3.99"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020083","import_time":"2026-09-16T06:56:08.607863721Z","modified_time":"2026-09-16T06:31:29Z","sha256":"1e843727c643c5d966acaa66461f7e392813a4284cd8181b4bb9b24ddfb8447a","source":"amazon-inspector","versions":["1.3.99"]}]}}