Malicious code in agency-testts (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ac3bbe97b41f8d8d1a74e9f369318620c08d648365a4e78d49d1da31d085531d) package.json declares a postinstall lifecycle hook `wscript.exe 4444.vbs` that auto-runs on `npm install` on Windows. The bundled 4444.vbs is a ~674KB script containing large opaque base64 blobs and an AES key/IV pair (`stateFKK`, `manifestGCP`) which it uses at runtime to decrypt an embedded payload via `CreateDecryptor().TransformFinalBlock` and hand it to `C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe` for execution. After staging, the script self-cleans with `cmd.exe /c ping 127.0.0.1 -n 8 >nul & del /f /q... & rmdir /s /q...` to remove its own artifacts. Cover-story comments label the script a `Sync Agent — diagnostic telemetry collector` from a fictitious `Wingtip Toys Corporation`, but the code performs no telemetry-shaped behavior — it decrypts and executes an opaque payload. The package ships no other functionality; installing it on Windows results in arbitrary attacker code running under the installer's user account.
Malicious code in agency-testts (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ac3bbe97b41f8d8d1a74e9f369318620c08d648365a4e78d49d1da31d085531d) package.json declares a postinstall lifecycle hook `wscript.exe 4444.vbs` that auto-runs on `npm install` on Windows. The bundled 4444.vbs is a ~674KB script containing large opaque base64 blobs and an AES key/IV pair (`stateFKK`, `manifestGCP`) which it uses at runtime to decrypt an embedded payload via `CreateDecryptor().TransformFinalBlock` and hand it to `C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe` for execution. After staging, the script self-cleans with `cmd.exe /c ping 127.0.0.1 -n 8 >nul & del /f /q... & rmdir /s /q...` to remove its own artifacts. Cover-story comments label the script a `Sync Agent — diagnostic telemetry collector` from a fictitious `Wingtip Toys Corporation`, but the code performs no telemetry-shaped behavior — it decrypts and executes an opaque payload. The package ships no other functionality; installing it on Windows results in arbitrary attacker code running under the installer's user account.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-17171
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6ab5fb95f7a7c5410655d1a1
Added to database: 09/25/2026, 04:41:57 UTC
Last updated: 09/25/2026, 04:41:57 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.