Later reports defuse the idea of IED components, but there is a question as to why it detonated when stepped on.
The Washington Post has more information on the person's condition, and the NYPD is claiming this was some sort of outdoor chemistry experiment. But it's not clear why it exploded on contact. Was it a plastic or liquid explosive (like the Underwear bomber)? Possibly sun exposure provided pre-heat that primed the mixture?
The young man is an undergraduate student at the University of Miami (FL). Media sources indicate that the university (apparently the health insurance provided to students) will cover the medical, prosthetic and rebab costs, which will probably run into hundred of thousands.
WJLA reports a Gofundme campaign set up with assistance from survivors of the Boston Marathon attack, link here. Presumably, and arrest would lead to charges of reckless endangerment and possibly arson. The police investigation sounds like a "Law and Order" episode.
CNN is reporting on 2016/7/14 that police have determined that the device contained TATP, an explosive popular with terrorists, and that it might have become unstable in the sun. The plastic bag was traced to a bakery in New Jersey, no longer in business. No other gear was found. It is unclear why it was left there.
The Daily Mail has a more detailed story on the attack. and the pictures and video are particularly disturbing.
Update: Dec. 12
Connor Golden has fought a long battle with his insurance company to get the prosthetic properly covered, after all. The Daily Mail story is here. NBC Washington will cover the insurance saga on Monday night Dec. 12 at 11 PM.