{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "index.js",
              "sha256": "94397cb3d725971892a20bbbcc2509009d4e15f96eab2e99bca04d6b0b05127b",
              "tlsh": "f31267897fe2f052d721647b6837625a632f4c8473084988f23615d0be1977af1b76ec"
            },
            {
              "path": "package.json",
              "sha256": "c0552adecca66ed6149b24cbed448fe5078c8df702c8d7dba4b23bd2278d5db3",
              "tlsh": "3bd0a7383961953305c606120c7aa45ab770df2f1044380987cb183c81df6b35cfa32d"
            }
          ],
          "package_integrity": [
            {
              "filename": "strict-uri-encode-1.0.1.tgz",
              "hashes": {
                "sha1": "cf0ffa0e74c1c1dd2bd4909c566eef0d2ff5e163",
                "sha512_sri": "sha512-w51inI48YEcRjhDF6776eIR8RbLSyyg9YVuOYnAA/OPoam+COg3PpZQesi/etByT/q5TGJdgUfBLlBWcX4zKBA=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "@httpactions/strict-uri-encode"
      },
      "versions": [
        "1.0.1"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-007015",
        "import_time": "2026-06-18T19:20:02.040734339Z",
        "modified_time": "2026-06-18T18:39:24Z",
        "sha256": "b90fd30f5d52b139ea7be77aa1782a5339f39355ec7ad532af2fa7a49616ff88",
        "source": "amazon-inspector",
        "versions": [
          "1.0.1"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b90fd30f5d52b139ea7be77aa1782a5339f39355ec7ad532af2fa7a49616ff88)\n@httpactions/strict-uri-encode impersonates the popular unscoped npm package \u0027strict-uri-encode\u0027 (~30M weekly downloads) by republishing the same name under a lookalike scope. The package ships no URI-encoding functionality; index.js is a heavily obfuscated dropper (obfuscator.io-style 110-entry rotating string array, base64-decoded module names for \u0027https\u0027, \u0027child_process\u0027, \u0027writeFileSync\u0027, \u0027exec\u0027, \u0027spawn\u0027, \u0027hostname\u0027, \u0027username\u0027) that executes immediately on require() and again every ~10 minutes via setInterval. The dropper assembles a hardcoded IP-based URL from base64 fragments (e.g. \u0027MC44Ni4x\u0027 \u2192 \u00270.86.117.x\u0027), HTTPS-GETs a remote payload, writes it to disk via fs.writeFileSync, and executes it via child_process.exec/spawn \u2014 yielding arbitrary remote code execution on any machine that requires the module. In parallel, bt() POSTs {ts, type, hid, ss, cc} containing os.hostname() and os.userInfo().username to the same hardcoded IP, exfiltrating installer host identity unconditionally on import and on the 10-minute timer. Combination of typosquatted name, zero legitimate functionality, heavy obfuscation, hardcoded IP C2, host-identity exfiltration, and require-time fetch-and-execute is an unambiguous supply-chain attack.\n",
  "id": "MAL-2026-6140",
  "modified": "2026-06-18T18:39:24Z",
  "published": "2026-06-18T18:39:24Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@httpactions/strict-uri-encode/v/1.0.1"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in @httpactions/strict-uri-encode (npm)"
}