MAL-2026-17170

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/agency-test-exercise/MAL-2026-17170.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17170
Published
2026-09-25T02:37:46Z
Modified
2026-09-25T03:00:06Z
Summary
Malicious code in agency-test-exercise (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (43eddaf152e2aa60b9f823513a2d9b11fc424a5cff4bb3c031f6823a48dc2f4e)

package.json declares a postinstall hook wscript.exe 4444.vbs that fires automatically on npm install. The shipped 4444.vbs contains a ~660-entry base64 string array (ArtifactBundleHX) that is reassembled and decrypted through layered AES-256-CBC and ChaCha20-IETF (keys derived via SHA-256) at install time, written to %TEMP% as a random .dat file, and passed to powershell.exe as a two-tier loader for in-memory execution / process hollowing. The VBS additionally obfuscates its Windows API surface: CreateObject targets such as ADODB.Stream and Msxml2.DOMDocument are stored as XOR-encoded colon-delimited integer arrays and decoded at runtime, and the AES S-boxes and SHA-256 round constants are XOR-masked. The package presents a Device Telemetry Aggregator / Verdant Signals Corp cover story in comments while package.json ships empty author and description fields. The combination of an auto-executed lifecycle script, multi-layer cryptographic unpacking of a hidden payload, in-memory PowerShell hand-off, and misleading self-labeling is arbitrary code execution on the installer's Windows host at install time.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020524",
            "import_time":  "2026-09-25T02:45:28.303747027Z",
            "modified_time":  "2026-09-25T02:37:46Z",
            "sha256":  "43eddaf152e2aa60b9f823513a2d9b11fc424a5cff4bb3c031f6823a48dc2f4e",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / agency-test-exercise

Package

Name
agency-test-exercise
View open source insights on deps.dev
Purl
pkg:npm/agency-test-exercise

Affected ranges

Affected versions

1.*
1.0.2

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "4444.vbs",
            "sha256":  "89a31ec0719b2137938c892385823ffb993d2d903e1fdfe17b246ba88531609a",
            "tlsh":  "daf4f034658a68abb63bcafeace6c72935147c053040606c35deb6581bfdcd15bda0f8"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "agency-test-exercise-1.0.2.tgz",
            "hashes":  {
                "sha1":  "26e555fcef57501fb21d4b38904d786721fef9ae",
                "sha512_sri":  "sha512-aAXmQ489ygSltIFn1FspFxlm7+IqHg3EFlVyg1d5wk9lNMg/VkrZXX7t2LDu4VNb14Ar5kcRpPjSqMeV/2aNUA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/agency-test-exercise/MAL-2026-17170.json"