MAL-2026-16076 Malicious code in external_deps_enjoyer (npm)
Malicious package
Published
MAL-2026-16076 is a malicious package: external_deps_enjoyer (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-16076/ (Markdown: https://insights.sbomify.com/MAL-2026-16076/index.md)
- Package
- external_deps_enjoyer
- Registry
- npm
What is MAL-2026-16076?
MAL-2026-16076 is a malicious package in external_deps_enjoyer, published on 9 Sep 2026.
Official description
package.json declares dependencies and optionalDependencies whose specifiers point at non-registry, attacker-controlled or mutable sources rather than the npm registry. Listed sources include a Discord CDN attachment tarball (cdn.discordapp.com/attachments/…/runtime.tgz), plain-HTTP tarballs at bare IPs (http://203.0.113.77:8443/drop/pkg.tgz, HTTP://198.51.100.44/…/pkg.tgz), git://203.0.113.91/hidden/repo.git, an ngrok tunnel (abc123xyz.ngrok-free.app), rentry.co raw content, gist shorthands (gist:c0ffee00deadbeef), and github/gitlab/bitbucket shorthands to throwaway repos (tmp-drop-8821/…). Specifier keys are duplicated with case variants (tarball-http vs tarball-HTTP, github-shorthand vs GITHUB-shorthand) and mix uppercase URI schemes with scp-style git refs and local path forms (link:, portal:, file:, /tmp/…, \Windows\Temp...), a pattern engineered to evade regex-based scanners. On npm install, npm fetches each specifier and executes any lifecycle scripts the fetched package declares; because the sources are mutable and controlled by third parties, the code that runs is whatever the operators of those hosts currently serve.
What should I do about MAL-2026-16076?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.