Malicious code in agency-testts (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ac3bbe97b41f8d8d1a74e9f369318620c08d648365a4e78d49d1da31d085531d) package.json declares a postinstall lifecycle hook `wscript.exe 4444.vbs` that auto-runs on `npm install` on Windows. The bundled 4444.vbs is a ~674KB script containing large opaque base64 blobs and an AES key/IV pair (`stateFKK`, `manifestGCP`) which it uses at runtime to decrypt an embedded payload via `CreateDecryptor().TransformFinalBlock` and hand it to `C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe` for execution. After staging, the script self-cleans with `cmd.exe /c ping 127.0.0.1 -n 8 >nul & del /f /q... & rmdir /s /q...` to remove its own artifacts. Cover-story comments label the script a `Sync Agent — diagnostic telemetry collector` from a fictitious `Wingtip Toys Corporation`, but the code performs no telemetry-shaped behavior — it decrypts and executes an opaque payload. The package ships no other functionality; installing it on Windows results in arbitrary attacker code running under the installer's user account.
MAL-2026-17171
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17171
agency-testts
Source reference: /affected/0/package/name
- Affected versions
- 1.0.0
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "agency-testts",
"purl": "pkg:npm/agency-testts",
"ecosystem": "npm"
},
"versions": [
"1.0.0"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/agency-testts/MAL-2026-17171.json",
"indicators": {
"evidence_files": [
{
"path": "package.json",
"tlsh": "d4d0a7164c44556329f487a409714406b5514f1f11304c47b2fb741884e76b24889f17",
"sha256": "ef4b97e89a4aa7ac6165ef9d8eaa769aa5d541b92e8ec74fa2d4d48e4b18b11c"
},
{
"path": "4444.vbs",
"tlsh": "64e4013a1e1c4725a6aa6d8ca7e30077adef2e0b11117c877f5d1c511bf2296e4e3a1c",
"sha256": "4c3218af4966a2fcb590bb3a1a459f12d626e400f036651986044306b967b1fb"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "d90958337c1fe793543cac3f3565d6be58ec11bf",
"sha512_sri": "sha512-UqLBFzm1pKNhB3Qtmt77AU60nIlKgxXy4qgdU+FsZwUeNOJdsuFawWgbZIXVwAtYNs/f3UzEf/XrdTCI0BSriw=="
},
"filename": "agency-testts-1.0.0.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #14778 · Revision 1
- Added to Heist Feed
- Publisher date