Malicious code in test-agency-assign (npm)
Historical advisory saved 24 Oct 2026 13:17:17 UTC. The publisher may have updated it since then. Latest advisory.
osv · MAL-2026-17295
Published--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (e650e815b4409c3c07cdab7c953ed69b8052f32a28c3686397ab362bb1bd4552) [email protected] declares a package.json postinstall script `wscript.exe Kelimasow.exe` that auto-executes a bundled 8.4 MB Go-compiled Windows PE (Kelimasow.exe, sha256 875c7641dc980538f3c3d8b344d173f97cf64a5d97dcf88d8e2932c83b876b92) on `npm install`. The package has no README, empty description and author fields, no source code, and no other functional content — the manifest is a thin wrapper whose sole install-time effect is to execute an opaque native binary on the installer's machine. Opaque binary + lifecycle-hook auto-execution + missing metadata is the canonical install-time RCE / dropper packaging shape, giving whoever published this arbitrary code execution on any Windows host that installs the package.
- Source published
- 29 Sep 2026 23:05:30 UTC
- Source modified
- 29 Sep 2026 23:30:04 UTC
- Saved here
- 24 Oct 2026 13:17:17 UTC
- Source terms
- OSV · upstream source license applies
Original source record · Cite this exact observation · Complete original publisher JSON
Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.