MAL-2026-17171

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/agency-testts/MAL-2026-17171.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17171
Published
2026-09-25T02:38:03Z
Modified
2026-09-25T03:00:06Z
Summary
Malicious code in agency-testts (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ac3bbe97b41f8d8d1a74e9f369318620c08d648365a4e78d49d1da31d085531d)

package.json declares a postinstall lifecycle hook wscript.exe 4444.vbs that auto-runs on npm install on Windows. The bundled 4444.vbs is a ~674KB script containing large opaque base64 blobs and an AES key/IV pair (stateFKK, manifestGCP) which it uses at runtime to decrypt an embedded payload via CreateDecryptor().TransformFinalBlock and hand it to C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe for execution. After staging, the script self-cleans with cmd.exe /c ping 127.0.0.1 -n 8 >nul & del /f /q... & rmdir /s /q... to remove its own artifacts. Cover-story comments label the script a Sync Agent — diagnostic telemetry collector from a fictitious Wingtip Toys Corporation, but the code performs no telemetry-shaped behavior — it decrypts and executes an opaque payload. The package ships no other functionality; installing it on Windows results in arbitrary attacker code running under the installer's user account.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020526",
            "import_time":  "2026-09-25T02:45:28.358535604Z",
            "modified_time":  "2026-09-25T02:38:03Z",
            "sha256":  "ac3bbe97b41f8d8d1a74e9f369318620c08d648365a4e78d49d1da31d085531d",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / agency-testts

Package

Name
agency-testts
View open source insights on deps.dev
Purl
pkg:npm/agency-testts

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "package.json",
            "sha256":  "ef4b97e89a4aa7ac6165ef9d8eaa769aa5d541b92e8ec74fa2d4d48e4b18b11c",
            "tlsh":  "d4d0a7164c44556329f487a409714406b5514f1f11304c47b2fb741884e76b24889f17"
        },
        {
            "path":  "4444.vbs",
            "sha256":  "4c3218af4966a2fcb590bb3a1a459f12d626e400f036651986044306b967b1fb",
            "tlsh":  "64e4013a1e1c4725a6aa6d8ca7e30077adef2e0b11117c877f5d1c511bf2296e4e3a1c"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "agency-testts-1.0.0.tgz",
            "hashes":  {
                "sha1":  "d90958337c1fe793543cac3f3565d6be58ec11bf",
                "sha512_sri":  "sha512-UqLBFzm1pKNhB3Qtmt77AU60nIlKgxXy4qgdU+FsZwUeNOJdsuFawWgbZIXVwAtYNs/f3UzEf/XrdTCI0BSriw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/agency-testts/MAL-2026-17171.json"