{"id":"MAL-2026-17316","revision":"0ad22adafcfa4e5ea7698ea49027731d","records":[{"revision":"0ad22adafcfa4e5ea7698ea49027731d","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17316","aliases":[],"title":"Malicious code in booking-eligibility (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2c93f5b06720659d8e0cc8efb7d6bd75f577605e84c27cfb600a795081c27654)\npackage.json declares a postinstall lifecycle hook `wscript.exe 4444.vbs` that runs Windows Script Host against a `.vbs` file on `npm install`. The referenced `4444.vbs` is not shipped in the tarball, so the hook either fails or (if the file is dropped by another mechanism or provided out-of-band) executes attacker-authored VBScript on the installer's machine at install time. The README explicitly claims 'No installation scripts', directly contradicting the manifest — a cover-story mismatch that misrepresents install-time behavior. The `4444` filename mirrors a well-known reverse-shell port convention. The package presents no legitimate functionality justifying WSH execution at install time.\n","state":0,"publishedAt":"2026-09-30T03:08:36+00:00","modifiedAt":"2026-09-30T03:30:04.9729038+00:00","affected":[{"ecosystem":"npm","name":"booking-eligibility","ranges":[],"versions":["1.0.0"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/booking-eligibility/v/1.0.0"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17316","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17316","identifiers":["MAL-2026-17316"]},"retained":false,"historicalAffected":[]}],"coverage":[]}