MalwarePublished 30 Sep 2026

booking-eligibility (npm) · Malicious Code

Affects booking-eligibilitySource GCVE Database

Malicious package : remove booking-eligibility and rotate any secrets on hosts that installed it.

Data as of 30 Sep 2026, 16:40 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-17316

What to do

Remove booking-eligibility from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmbooking-eligibility	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'booking-eligibility' version 1.0.0 contains a malicious postinstall script that attempts to execute a Windows Script Host (WSH) VBScript file named '4444.vbs' during installation. This script is not included in the package tarball, meaning the hook either fails or could execute attacker-supplied code if the file is provided by other means. The package's README falsely claims there are no installation scripts, misleading users about its behavior. The '4444.vbs' filename suggests a potential reverse-shell payload, indicating malicious intent. The package does not provide legitimate functionality to justify this behavior.

Impact

If the '4444.vbs' file is supplied out-of-band or dropped by another mechanism, the postinstall script could execute arbitrary VBScript code on the installer's Windows machine, potentially enabling remote code execution or establishing a reverse shell. This could compromise the affected system's security and integrity. If the file is not present, the script fails silently but the presence of the malicious hook itself indicates a supply chain risk.

Defensive guidance

Users should avoid installing 'booking-eligibility' version 1.0.0. Since the malicious postinstall script depends on an external VBScript file not included in the package, ensuring that no such file is present or introduced can prevent execution. Users should verify package integrity and prefer trusted packages. Monitoring for unexpected postinstall scripts in npm packages is recommended.

Summary

The 'booking-eligibility' npm package version 1.0.0 declares a postinstall lifecycle hook that runs 'wscript.exe 4444.vbs' on Windows systems during 'npm install'. The referenced VBScript file '4444.vbs' is absent from the package tarball, so the script either fails or executes attacker-controlled code if the file is introduced by other means. The package manifest contradicts the README, which claims no installation scripts exist, indicating deliberate obfuscation. The use of '4444.vbs' aligns with known reverse-shell port conventions, suggesting the script could establish unauthorized remote access. The package lacks any legitimate functionality that would require executing WSH scripts at install time, confirming its malicious nature.

References

npmjs.com/package/booking-eligibility/v/1.0.0 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 30 Sep 2026, 16:40 UTC

Technical details

References

Community reviews