Malicious code in studiocode_eligibility (npm)

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (a49b1af8bbf0463bb38d3049e59c28b0dcc8d2e3e5ef54611b4e77bddfdd36dc) package.json declares a postinstall hook `wscript.exe 4444.vbs` that automatically executes a 765KB VBScript shipped in the tarball on Windows installers. The VBS contains multi-layer obfuscation (XOR-decoded AES S-boxes, SHA-256 constants, a ChaCha20 stream layer, and a large Base64 'ArtifactBundleHX' blob) that decrypts a PowerShell loader, writes it to %TEMP%\pf#####.dat, and invokes it via powershell.exe using process-hollowing-style techniques. The library source (src/index.js) is a small Zod-based email-domain eligibility checker that is unrelated to the VBS payload and serves as cover. The README explicitly claims 'Checks run locally, without network requests' and 'There are no installation scripts', directly contradicting the declared postinstall hook and shipped dropper. Running `npm install studiocode_eligibility` on Windows grants the package author arbitrary code execution on the installer's machine.

Source published

4 Oct 2026 23:25:45 UTC

Source modified

4 Oct 2026 23:45:20 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.