{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "loader.js",
              "sha256": "21bfaa51988b8dc7220f58d33e570d50ce43bc6103f872fda68db1eafe7729c6",
              "tlsh": "7e5121a60afb3512027770e6bb0b596a96bbe113314ec994fa9cc3d44fc2421d6d72dc"
            },
            {
              "path": "index.js",
              "sha256": "659612116d1f68484c789fe7095bb0ad7c9d0bdb5c5b10fa67e761bc286c117e",
              "tlsh": "82f0ac4b10836763855be3969652d0c00a7a8a0c3644ba02481f52bd0f940958356f53"
            },
            {
              "path": "package.json",
              "sha256": "091e2107daf39d80e08f34445a3f8faaee710c2b9601ce5e040855337e33bca1",
              "tlsh": "b301f512caa1ac9311c9ae5abd9a464761b10e434605fd093797122c4fae16f60ff66c"
            }
          ],
          "package_integrity": [
            {
              "filename": "engin1-1.3.99.tgz",
              "hashes": {
                "sha1": "8864e8d1c466f490a5e3f1e2f49158c6b31d006b",
                "sha512_sri": "sha512-jW/oKqEnJehcMW0Qq2VguD8qnkWaXKKIPEv9SePhnaSLjQEIiN/M1vUSluqASyQA927RrmHeeuB5HyJYCJ2eIQ=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "engin1"
      },
      "versions": [
        "1.3.99"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-020083",
        "import_time": "2026-09-16T06:56:08.607863721Z",
        "modified_time": "2026-09-16T06:31:29Z",
        "sha256": "1e843727c643c5d966acaa66461f7e392813a4284cd8181b4bb9b24ddfb8447a",
        "source": "amazon-inspector",
        "versions": [
          "1.3.99"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1e843727c643c5d966acaa66461f7e392813a4284cd8181b4bb9b24ddfb8447a)\nThe package\u0027s main entrypoint (index.js) invokes an initializer at top level that spawns loader.js as a detached background Node process on every require/import. loader.js issues an HTTPS GET to https://api.npoint.io/24c25d5f5fcbb0992a4f, base64-decodes the JSON `code` field, and passes the decoded string to `new Function(require, __dirname, __filename, module, exports,...)`, executing attacker-controlled JavaScript with full Node privileges as the installing user. The endpoint URL is stored in a variable named `API_KEY` to disguise its nature, and the manifest/README advertise a runtime/system-info utility with a `getRuntimeInfo()` API that does not exist in the shipped code. The api.npoint.io document is attacker-mutable, unauthenticated, and unpinned, so whoever controls that bin controls what runs on any host importing this package.\n",
  "id": "MAL-2026-16215",
  "modified": "2026-09-16T06:31:29Z",
  "published": "2026-09-16T06:31:29Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/engin1/v/1.3.99"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in engin1 (npm)"
}