{"id":"MAL-2026-17295","revision":"ba8a19bb575d4ae7bd0cefdfa7f58024","records":[{"revision":"ba8a19bb575d4ae7bd0cefdfa7f58024","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17295","aliases":[],"title":"Malicious code in test-agency-assign (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e650e815b4409c3c07cdab7c953ed69b8052f32a28c3686397ab362bb1bd4552)\ntest-agency-assign@1.0.4 declares a package.json postinstall script `wscript.exe Kelimasow.exe` that auto-executes a bundled 8.4 MB Go-compiled Windows PE (Kelimasow.exe, sha256 875c7641dc980538f3c3d8b344d173f97cf64a5d97dcf88d8e2932c83b876b92) on `npm install`. The package has no README, empty description and author fields, no source code, and no other functional content — the manifest is a thin wrapper whose sole install-time effect is to execute an opaque native binary on the installer's machine. Opaque binary + lifecycle-hook auto-execution + missing metadata is the canonical install-time RCE / dropper packaging shape, giving whoever published this arbitrary code execution on any Windows host that installs the package.\n","state":0,"publishedAt":"2026-09-29T23:05:30+00:00","modifiedAt":"2026-09-29T23:30:04.9709501+00:00","affected":[{"ecosystem":"npm","name":"test-agency-assign","ranges":[],"versions":["1.0.4"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/test-agency-assign/v/1.0.4"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17295","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17295","identifiers":["MAL-2026-17295"]},"retained":false,"historicalAffected":[]}],"coverage":[]}