{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "lib/registry.js",
              "sha256": "dcfb9e5cbe24accdb2a5dc35eb3e30ca9a20d848c05644ab57e8434f33125ff7",
              "tlsh": "5001d08371a2914b37c44adfb35e354728919309e95270b1a8e9014f498c92d0276787"
            }
          ],
          "package_integrity": [
            {
              "filename": "endpointmap-2.1.0.tgz",
              "hashes": {
                "sha1": "084e1c14f8f0aaa6f9fc7ab8f070b17f1ff94a3c",
                "sha512_sri": "sha512-43OeYW2XjaN6eL66ZTOIxy2vO5cS89ULkkUxgJ/xBosQ9kil8oqRP6xIR1Nc9M9siRktZvW82ZOEMvt9rsaCDw=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "endpointmap"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": [
        "2.1.0",
        "3.0.0"
      ]
    }
  ],
  "aliases": [
    "GHSA-p3qr-5g48-8w89"
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-007783",
        "import_time": "2026-06-29T09:10:17.671131754Z",
        "modified_time": "2026-06-29T08:53:06Z",
        "ranges": [
          {
            "events": [
              {
                "introduced": "0"
              }
            ],
            "type": "SEMVER"
          }
        ],
        "sha256": "3037e91395714302068c117c15fb5b86a617068510019cd64b9f6a925593c5f7",
        "source": "amazon-inspector",
        "versions": [
          "2.1.0"
        ]
      },
      {
        "id": "IN-MAL-2026-007782",
        "import_time": "2026-06-29T09:10:17.548831333Z",
        "modified_time": "2026-06-29T08:52:54Z",
        "ranges": [
          {
            "events": [
              {
                "introduced": "0"
              }
            ],
            "type": "SEMVER"
          }
        ],
        "sha256": "aa2ddbcbdd90508af14415a021644c1ab8a57e432b526425e4c5128b23f897bb",
        "source": "amazon-inspector",
        "versions": [
          "3.0.0"
        ]
      },
      {
        "id": "GHSA-p3qr-5g48-8w89",
        "import_time": "2026-06-30T16:57:44.029691132Z",
        "modified_time": "2026-06-30T16:18:12Z",
        "ranges": [
          {
            "events": [
              {
                "introduced": "0"
              }
            ],
            "type": "SEMVER"
          }
        ],
        "sha256": "7cf1ae7dc26d8ebda1199b5e88d8fb0d49e4db8f72ff01b5f2b0dea88cf4a8a0",
        "source": "ghsa-malware"
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (aa2ddbcbdd90508af14415a021644c1ab8a57e432b526425e4c5128b23f897bb)\nendpointmap advertises itself as a REST endpoint registry but exhibits a two-package smuggle pattern. lib/registry.js exports two non-printable byte arrays (`_ep` of length 36, `_p` of length 7) annotated as \u0027Endpoint host segment\u0027 / \u0027Endpoint path segment\u0027, with a comment claiming they are \u0027processed at runtime by the consumer for portability.\u0027 Neither array is read anywhere in endpointmap\u0027s own code \u2014 index.js only exposes the registry object \u2014 and the bytes are opaque (XOR-shaped, with no key shipped in this package). At the same time, package.json declares `\"bytecraft\": \"*\"` as a dependency. endpointmap\u0027s source never `require`s bytecraft; the only effect of the declaration is to force installation of whatever `bytecraft@latest` happens to be at install time. The combination \u2014 staged encoded data in this package plus an unpinned, never-imported sibling that can be updated to act as the decoder/runtime \u2014 is the canonical \u0027data here, decoder there\u0027 split designed to evade per-package review. An installer of endpointmap is exposed to whatever bytecraft resolves to at install/require time, including future malicious versions, without endpointmap itself ever needing another release.\n\n## Source: ghsa-malware (7cf1ae7dc26d8ebda1199b5e88d8fb0d49e4db8f72ff01b5f2b0dea88cf4a8a0)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n",
  "id": "MAL-2026-6588",
  "modified": "2026-06-30T16:59:28Z",
  "published": "2026-06-29T08:52:54Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/endpointmap/v/2.1.0"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/endpointmap/v/3.0.0"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-p3qr-5g48-8w89"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in endpointmap (npm)"
}