MAL-2026-17171

    Dashboard / Malicious Package / MAL-2026-17171

    MAL-2026-17171

    Published: 25 Sept 2026Last Modified: 25 Sept 2026

    Summary: Malicious code in agency-testts (npm)

    Details: Source: amazon-inspector (ac3bbe97b41f8d8d1a74e9f369318620c08d648365a4e78d49d1da31d085531d) package.json declares a postinstall lifecycle hook `wscript.exe 4444.vbs` that auto-runs on `npm install` on Windows. The bundled 4444.vbs is a ~674KB script containing large opaque base64 blobs and an AES key/IV pair (`stateFKK`, `manifestGCP`) which it uses at runtime to decrypt an embedded payload via `CreateDecryptor().TransformFinalBlock` and hand it to `C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe` for execution. After staging, the script self-cleans with `cmd.exe /c ping 127.0.0.1 -n 8 >nul & del /f /q... & rmdir /s /q...` to remove its own artifacts. Cover-story comments label the script a `Sync Agent — diagnostic telemetry collector` from a fictitious `Wingtip Toys Corporation`, but the code performs no telemetry-shaped behavior — it decrypts and executes an opaque payload. The package ships no other functionality; installing it on Windows results in arbitrary attacker code running under the installer's user account.

    References: https://www.npmjs.com/package/agency-testts/v/1.0.0

    Affected packages

    Package

    Name: agency-testts

    Purl: pkg:npm/agency-testts

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0