engin1

GHSA-8v43-g45f-4c59

Malicious code in engin1 (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.3.99`

## Source: amazon-inspector (1e843727c643c5d966acaa66461f7e392813a4284cd8181b4bb9b24ddfb8447a)
The package's main entrypoint (index.js) invokes an initializer at top level that spawns loader.js as a detached background Node process on every require/import. loader.js issues an HTTPS GET to https://api.npoint.io/24c25d5f5fcbb0992a4f, base64-decodes the JSON `code` field, and passes the decoded string to `new Function(require, __dirname, __filename, module, exports,...)`, executing attacker-controlled JavaScript with full Node privileges as the installing user. The endpoint URL is stored in a variable named `API_KEY` to disguise its nature, and the manifest/README advertise a runtime/system-info utility with a `getRuntimeInfo()` API that does not exist in the shipped code. The api.npoint.io document is attacker-mutable, unauthenticated, and unpinned, so whoever controls that bin controls what runs on any host importing this package.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/7f1aa138541a03139444da6ce5a68c006904fd72/osv/malicious/npm/engin1/MAL-2026-16215.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/7f1aa138541a03139444da6ce5a68c006904fd72/osv/malicious/npm/engin1/MAL-2026-16215.json
- https://www.npmjs.com/package/engin1/v/1.3.99
- https://github.com/advisories/GHSA-8v43-g45f-4c59

Compromised versions (1)

= 1.3.99

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.