Malicious code in external_deps_enjoyer (npm)
Affects external_deps_enjoyerSource GCVE Database
Rated by Threat Radar
Data as of 09/09/2026, 13:59:44 UTC
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmexternal_deps_enjoyer | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Until a fix is available, users should avoid installing or using external_deps_enjoyer version 1.0.0. Review and audit dependencies for references to non-registry or mutable sources before installation.
Description
The npm package external_deps_enjoyer version 1.0.0 declares dependencies and optionalDependencies that point to non-registry, attacker-controlled, or mutable sources. These sources include URLs from Discord CDN, plain HTTP tarballs at IP addresses, git repositories over git:// protocol, ngrok tunnels, rentry.co raw content, gist shorthands, and throwaway GitHub/GitLab/Bitbucket repositories. This pattern is designed to evade regex-based scanners. When npm installs the package, it fetches and executes lifecycle scripts from these mutable third-party sources, potentially running malicious code.
Impact
Users installing external_deps_enjoyer version 1.0.0 may unknowingly execute arbitrary code controlled by attackers due to the package's reliance on mutable, third-party sources for dependencies. This can lead to compromise of the environment where npm install is run. No known exploits in the wild have been reported yet.
Summary
The external_deps_enjoyer npm package version 1.0.0 uses package.json dependencies and optionalDependencies with specifiers that reference mutable and attacker-controlled sources rather than the official npm registry. These sources include various HTTP and git URLs, some using uncommon or mixed casing schemes to evade detection. Because npm executes lifecycle scripts from fetched packages, the code executed during installation can be controlled by third parties hosting these sources, enabling execution of arbitrary malicious code.