Malicious code in lite-matterr (npm)

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (cc9b5f5edaae9103fd26de7cb70e661d78d6948dc3c519fec6b4b62fd471fbfc) [email protected] declares a postinstall hook in package.json that runs `wscript.exe 4444.vbs` on `npm install`. The bundled 4444.vbs is a ~765KB heavily obfuscated VBScript containing layered decryption routines (XOR-masked AES S-boxes, a ChaCha20 stream layer, SHA-256 round constants XORed with 0x5A5A5A5A) and a ~600-entry base64 bundle that it concatenates and decrypts into a PowerShell loader. The decrypted loader is written to %TEMP%\pf<rand>.dat and executed via powershell.exe, with internal comments referencing process hollowing. The README falsely claims 'No network requests. No personal data storage. No installation scripts.', directly contradicting the declared postinstall. The package presents a 'Device Telemetry Aggregator' cover story while actually delivering a multi-stage Windows dropper that achieves code execution on any host that installs the package.

Source published

4 Oct 2026 23:27:32 UTC

Source modified

4 Oct 2026 23:45:20 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.