Skip to content
Heist/ feed
Unrated

Malicious code in agency-test-exercise (npm)

Type: advisorySource: OSV1 source record

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (43eddaf152e2aa60b9f823513a2d9b11fc424a5cff4bb3c031f6823a48dc2f4e) package.json declares a postinstall hook `wscript.exe 4444.vbs` that fires automatically on `npm install`. The shipped 4444.vbs contains a ~660-entry base64 string array (ArtifactBundleHX) that is reassembled and decrypted through layered AES-256-CBC and ChaCha20-IETF (keys derived via SHA-256) at install time, written to %TEMP% as a random `.dat` file, and passed to powershell.exe as a two-tier loader for in-memory execution / process hollowing. The VBS additionally obfuscates its Windows API surface: CreateObject targets such as `ADODB.Stream` and `Msxml2.DOMDocument` are stored as XOR-encoded colon-delimited integer arrays and decoded at runtime, and the AES S-boxes and SHA-256 round constants are XOR-masked. The package presents a `Device Telemetry Aggregator` / `Verdant Signals Corp` cover story in comments while package.json ships empty author and description fields. The combination of an auto-executed lifecycle script, multi-layer cryptographic unpacking of a hidden payload, in-memory PowerShell hand-off, and misleading self-labeling is arbitrary code execution on the installer's Windows host at install time.

Announced Source revision 1
Original source ↗

MAL-2026-17170

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:MAL-2026-17170

agency-test-exercise

Source reference: /affected/0/package/name

Affected versions
1.0.2

Source reference: /affected/0/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "package": {
      "name": "agency-test-exercise",
      "purl": "pkg:npm/agency-test-exercise",
      "ecosystem": "npm"
    },
    "versions": [
      "1.0.2"
    ],
    "database_specific": {
      "cwes": [
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        }
      ],
      "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/agency-test-exercise/MAL-2026-17170.json",
      "indicators": {
        "evidence_files": [
          {
            "path": "4444.vbs",
            "tlsh": "daf4f034658a68abb63bcafeace6c72935147c053040606c35deb6581bfdcd15bda0f8",
            "sha256": "89a31ec0719b2137938c892385823ffb993d2d903e1fdfe17b246ba88531609a"
          }
        ],
        "package_integrity": [
          {
            "hashes": {
              "sha1": "26e555fcef57501fb21d4b38904d786721fef9ae",
              "sha512_sri": "sha512-aAXmQ489ygSltIFn1FspFxlm7+IqHg3EFlVyg1d5wk9lNMg/VkrZXX7t2LDu4VNb14Ar5kcRpPjSqMeV/2aNUA=="
            },
            "filename": "agency-test-exercise-1.0.2.tgz"
          }
        ]
      }
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#14777 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement