{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "index.js",
              "sha256": "f9026264d06046512d73d8d580f36b273c672cfe2b4652db59d336ca9fb40969",
              "tlsh": "fa2266c53ff2b017d220247b382a5256a22f4c84774c4998e62665c4fe5a7b6f0b76dc"
            },
            {
              "path": "package.json",
              "sha256": "d09ad41537d0904ccdc70a6372a0ff25c3c5372606568f086ba82f70968f4abc",
              "tlsh": "86d0a7382951553305c641120c6ea446b361df2f1044380d87db583c81dfab35cfa31d"
            }
          ],
          "package_integrity": [
            {
              "filename": "encode-url-1.0.0.tgz",
              "hashes": {
                "sha1": "6804b6c63a962a43d3ed4b7955f5107b3d102824",
                "sha512_sri": "sha512-+Z/oUOu4JJyOgzPDB+WPLLXGjSXlKSu1NP1o6x9d9liP0V0gy5blpSwDyWS4jYAoBNxorLXa5nDBYie2iY1Tlg=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "@httpactions/encode-url"
      },
      "versions": [
        "1.0.0",
        "1.0.1"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-007014",
        "import_time": "2026-06-18T19:20:01.922795314Z",
        "modified_time": "2026-06-18T18:39:23Z",
        "sha256": "2e52b15ad9413185c30f84ad7e11e031c74c359e04f5c30ce502b8bc73267d8e",
        "source": "amazon-inspector",
        "versions": [
          "1.0.0"
        ]
      },
      {
        "id": "IN-MAL-2026-007016",
        "import_time": "2026-06-18T19:20:02.11522741Z",
        "modified_time": "2026-06-18T18:39:28Z",
        "sha256": "5c9aa3e781989ddd45fd6b6d1c8eb3d0bfdd7ce29e16865593b4b6bf3d889ed8",
        "source": "amazon-inspector",
        "versions": [
          "1.0.1"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2e52b15ad9413185c30f84ad7e11e031c74c359e04f5c30ce502b8bc73267d8e)\nThe package ships a single heavily obfuscated index.js that performs no URL-encoding work despite the package name. On require() of the declared main, top-level invocation of Zt() triggers an HTTP GET to a hardcoded C2 endpoint whose URL is reconstructed from base64 fragments combined via an XOR routine (function H). The response body is written to disk via fs.writeFileSync and executed by child_process.exec / child_process.spawn using process.execPath (the local Node runtime). A second routine mt() POSTs host identifiers \u2014 os.hostname(), os.userInfo().username, platform, arch \u2014 to the same C2 on every load, and a setInterval re-runs the fetch-and-execute loop approximately every 615 seconds. All sensitive identifiers (\u0027child_process\u0027, \u0027fs\u0027, \u0027exec\u0027, \u0027spawn\u0027, \u0027writeFileSync\u0027, \u0027hostname\u0027, \u0027userInfo\u0027, etc.) are concealed as base64 strings with a leading-byte strip, behind an obfuscator.io string-array dispatcher. package.json has empty description, empty author, no repository, and the module exports nothing \u2014 the only effect of installing or requiring this package is the dropper. The @httpactions scope and the encode-url name are a lure with no matching functionality.\n",
  "id": "MAL-2026-6139",
  "modified": "2026-06-18T19:21:54Z",
  "published": "2026-06-18T18:39:23Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@httpactions/encode-url/v/1.0.0"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@httpactions/encode-url/v/1.0.1"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in @httpactions/encode-url (npm)"
}