engin1@1.3.99

Summary

The package's main entrypoint (index.js) invokes an initializer at top level that spawns loader.js as a detached background Node process on every require/import. loader.js issues an HTTPS GET to https://api.npoint.io/24c25d5f5fcbb0992a4f, base64-decodes the JSON code field, and passes the decoded string to new Function(require, __dirname, __filename, module, exports,...), executing attacker-controlled JavaScript with full Node privileges as the installing user. The endpoint URL is stored in a variable named API_KEY to disguise its nature, and the manifest/README advertise a runtime/system-info utility with a getRuntimeInfo() API that does not exist in the shipped code. The api.npoint.io document is attacker-mutable, unauthenticated, and unpinned, so whoever controls that bin controls what runs on any host importing this package.

Source: amazon-inspector (1e843727c643c5d966acaa66461f7e392813a4284cd8181b4bb9b24ddfb8447a)