Malicious code in external_deps_enjoyer (npm)
The npm package external_deps_enjoyer version 1.0.0 declares dependencies and optionalDependencies that point to non-registry, attacker-controlled, or mutable sources. These sources include URLs from Discord CDN, plain HTTP tarballs at IP addresses, git repositories over git:// protocol, ngrok tunnels, rentry.co raw content, gist shorthands, and throwaway GitHub/GitLab/Bitbucket repositories. This pattern is designed to evade regex-based scanners. When npm installs the package, it fetches and executes lifecycle scripts from these mutable third-party sources, potentially running malicious code.
AI Analysis
Technical Summary
The external_deps_enjoyer npm package version 1.0.0 uses package.json dependencies and optionalDependencies with specifiers that reference mutable and attacker-controlled sources rather than the official npm registry. These sources include various HTTP and git URLs, some using uncommon or mixed casing schemes to evade detection. Because npm executes lifecycle scripts from fetched packages, the code executed during installation can be controlled by third parties hosting these sources, enabling execution of arbitrary malicious code.
Potential Impact
Users installing external_deps_enjoyer version 1.0.0 may unknowingly execute arbitrary code controlled by attackers due to the package's reliance on mutable, third-party sources for dependencies. This can lead to compromise of the environment where npm install is run. No known exploits in the wild have been reported yet.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid installing or using external_deps_enjoyer version 1.0.0. Review and audit dependencies for references to non-registry or mutable sources before installation.
Malicious code in external_deps_enjoyer (npm)
Description
The npm package external_deps_enjoyer version 1.0.0 declares dependencies and optionalDependencies that point to non-registry, attacker-controlled, or mutable sources. These sources include URLs from Discord CDN, plain HTTP tarballs at IP addresses, git repositories over git:// protocol, ngrok tunnels, rentry.co raw content, gist shorthands, and throwaway GitHub/GitLab/Bitbucket repositories. This pattern is designed to evade regex-based scanners. When npm installs the package, it fetches and executes lifecycle scripts from these mutable third-party sources, potentially running malicious code.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The external_deps_enjoyer npm package version 1.0.0 uses package.json dependencies and optionalDependencies with specifiers that reference mutable and attacker-controlled sources rather than the official npm registry. These sources include various HTTP and git URLs, some using uncommon or mixed casing schemes to evade detection. Because npm executes lifecycle scripts from fetched packages, the code executed during installation can be controlled by third parties hosting these sources, enabling execution of arbitrary malicious code.
Potential Impact
Users installing external_deps_enjoyer version 1.0.0 may unknowingly execute arbitrary code controlled by attackers due to the package's reliance on mutable, third-party sources for dependencies. This can lead to compromise of the environment where npm install is run. No known exploits in the wild have been reported yet.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid installing or using external_deps_enjoyer version 1.0.0. Review and audit dependencies for references to non-registry or mutable sources before installation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-16076
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6aa15f82acd9273b496184ce
Added to database: 09/09/2026, 13:30:42 UTC
Last enriched: 09/09/2026, 13:59:44 UTC
Last updated: 09/09/2026, 19:21:08 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.