agency-test-exercise

{"modified":"2026-09-25T02:37:46Z","published":"2026-09-25T02:37:46Z","schema_version":"1.7.4","id":"MAL-2026-17170","summary":"Malicious code in agency-test-exercise (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (43eddaf152e2aa60b9f823513a2d9b11fc424a5cff4bb3c031f6823a48dc2f4e)\npackage.json declares a postinstall hook `wscript.exe 4444.vbs` that fires automatically on `npm install`. The shipped 4444.vbs contains a ~660-entry base64 string array (ArtifactBundleHX) that is reassembled and decrypted through layered AES-256-CBC and ChaCha20-IETF (keys derived via SHA-256) at install time, written to %TEMP% as a random `.dat` file, and passed to powershell.exe as a two-tier loader for in-memory execution / process hollowing. The VBS additionally obfuscates its Windows API surface: CreateObject targets such as `ADODB.Stream` and `Msxml2.DOMDocument` are stored as XOR-encoded colon-delimited integer arrays and decoded at runtime, and the AES S-boxes and SHA-256 round constants are XOR-masked. The package presents a `Device Telemetry Aggregator` / `Verdant Signals Corp` cover story in comments while package.json ships empty author and description fields. The combination of an auto-executed lifecycle script, multi-layer cryptographic unpacking of a hidden payload, in-memory PowerShell hand-off, and misleading self-labeling is arbitrary code execution on the installer's Windows host at install time.\n","affected":[{"package":{"ecosystem":"npm","name":"agency-test-exercise"},"versions":["1.0.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"4444.vbs","sha256":"89a31ec0719b2137938c892385823ffb993d2d903e1fdfe17b246ba88531609a","tlsh":"daf4f034658a68abb63bcafeace6c72935147c053040606c35deb6581bfdcd15bda0f8"}],"package_integrity":[{"filename":"agency-test-exercise-1.0.2.tgz","hashes":{"sha1":"26e555fcef57501fb21d4b38904d786721fef9ae","sha512_sri":"sha512-aAXmQ489ygSltIFn1FspFxlm7+IqHg3EFlVyg1d5wk9lNMg/VkrZXX7t2LDu4VNb14Ar5kcRpPjSqMeV/2aNUA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/agency-test-exercise/v/1.0.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020524","import_time":"2026-09-25T02:45:28.303747027Z","modified_time":"2026-09-25T02:37:46Z","sha256":"43eddaf152e2aa60b9f823513a2d9b11fc424a5cff4bb3c031f6823a48dc2f4e","source":"amazon-inspector","versions":["1.0.2"]}]}}