Malicious code in booking-eligibility (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2c93f5b06720659d8e0cc8efb7d6bd75f577605e84c27cfb600a795081c27654) package.json declares a postinstall lifecycle hook `wscript.exe 4444.vbs` that runs Windows Script Host against a `.vbs` file on `npm install`. The referenced `4444.vbs` is not shipped in the tarball, so the hook either fails or (if the file is dropped by another mechanism or provided out-of-band) executes attacker-authored VBScript on the installer's machine at install time. The README explicitly claims 'No installation scripts', directly contradicting the manifest — a cover-story mismatch that misrepresents install-time behavior. The `4444` filename mirrors a well-known reverse-shell port convention. The package presents no legitimate functionality justifying WSH execution at install time.
MAL-2026-17316
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17316
booking-eligibility
Source reference: /affected/0/package/name
- Affected versions
- 1.0.0
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "booking-eligibility",
"purl": "pkg:npm/booking-eligibility",
"ecosystem": "npm"
},
"versions": [
"1.0.0"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/booking-eligibility/MAL-2026-17316.json",
"indicators": {
"evidence_files": [
{
"path": "package.json",
"tlsh": "f5e022238954ab6721f9e7b2ad354243b6690e0f02604c0730fb125c4b616b7209fb2d",
"sha256": "3d0dc0d7ff9bb2ef305e4069ce709ee1223dd2a3b367145a5b3a6e3a1e39d787"
},
{
"path": "readme.md",
"tlsh": "3c3100444c23e37935b1e31bbc90b092e7f4915c0aa60c51b9aa835e1315f62fb7f84e",
"sha256": "11f2ec1d479385714632f19967af06a5273b66baf7ffab8c9f9e400092735026"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "5692583fd2e6a66ae9d9603c408cbc84ba5e0e1f",
"sha512_sri": "sha512-5BFi4KRLXKJVpAnBnlmLnf/B4OntDmcz/Bkuj+gN664faIwx5dQ0MnpwruwZCFWmdDbm76894GbOl2qNph/x4w=="
},
"filename": "booking-eligibility-1.0.0.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #33454 · Revision 1
- Added to Heist Feed
- Publisher date