{"id":"MAL-2026-17239","revision":"b8d14ccb73fa490b88b8191b70f98a4e","records":[{"revision":"b8d14ccb73fa490b88b8191b70f98a4e","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17239","aliases":[],"title":"Malicious code in test-agency-assignment (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (dcdf62e1c1eb44ca7a29ed37c12bdb71883025a46c5066e58c9228f0dfe782c2)\npackage.json declares a postinstall lifecycle script `wscript.exe 4444.vbs`, causing the VBS file shipped in the tarball to run automatically on `npm install` on Windows hosts. 4444.vbs contains a hand-rolled multi-layer decoder (Base64, an XOR-masked AES S-box, ChaCha20-IETF, additional XOR) that concatenates hundreds of embedded ~2KiB Base64 chunks stored in `ArtifactBundleHX(...)`, decrypts them, writes the resulting PowerShell loader to a randomly named file under %TEMP% (`pf<rand>.dat`), and invokes powershell.exe against it. In-file comments describe the handoff to PowerShell as being for process hollowing. The file header presents a benign 'Device Telemetry Aggregator' cover story that does not match the shipped behavior. The package's only functional content is this dropper; installing the package on Windows results in arbitrary attacker-controlled code execution on the installer's host.\n","state":0,"publishedAt":"2026-09-28T22:03:04+00:00","modifiedAt":"2026-09-28T22:30:06.8055877+00:00","affected":[{"ecosystem":"npm","name":"test-agency-assignment","ranges":[],"versions":["1.0.2"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/test-agency-assignment/v/1.0.2"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17239","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17239","identifiers":["MAL-2026-17239"]},"retained":false,"historicalAffected":[]}],"coverage":[]}