MAL-2026-16215

    Dashboard / Malicious Package / MAL-2026-16215

    MAL-2026-16215

    Published: 16 Sept 2026Last Modified: 16 Sept 2026

    Summary: Malicious code in engin1 (npm)

    Details: Source: amazon-inspector (1e843727c643c5d966acaa66461f7e392813a4284cd8181b4bb9b24ddfb8447a) The package's main entrypoint (index.js) invokes an initializer at top level that spawns loader.js as a detached background Node process on every require/import. loader.js issues an HTTPS GET to https://api.npoint.io/24c25d5f5fcbb0992a4f, base64-decodes the JSON `code` field, and passes the decoded string to `new Function(require, __dirname, __filename, module, exports,...)`, executing attacker-controlled JavaScript with full Node privileges as the installing user. The endpoint URL is stored in a variable named `API_KEY` to disguise its nature, and the manifest/README advertise a runtime/system-info utility with a `getRuntimeInfo()` API that does not exist in the shipped code. The api.npoint.io document is attacker-mutable, unauthenticated, and unpinned, so whoever controls that bin controls what runs on any host importing this package.

    References: https://www.npmjs.com/package/engin1/v/1.3.99

    Affected packages

    Package

    Name: engin1

    Purl: pkg:npm/engin1

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.3.99