MAL-2026-17565

    Dashboard / Malicious Package / MAL-2026-17565

    MAL-2026-17565

    Published: 5 Oct 2026Last Modified: 5 Oct 2026

    Summary: Malicious code in typesens (npm)

    Details: Source: amazon-inspector (3ded39f31b2c2d4d73e0b576ab862c9ed90688153a43c359dae5b26854ad8738) package.json declares postinstall `wscript.exe 4444.vbs`, which runs automatically on `npm install`. The shipped 4444.vbs (~765 KB) contains a multi-layer decryption chain (AES S-box, ChaCha20-IETF, SHA-256 constants XOR-masked with 0x5A5A5A5A) over ~665 base64 chunks, decodes a payload to %TEMP% as a.dat file, drops a PowerShell loader, and invokes powershell.exe to perform process hollowing on Windows. Function names in the VBS are randomized (PlatformProbeLVI, DeviceCatalogUBYQ, EndpointRegistryRFX) and the `CreateObject` target is XOR-decoded at runtime; a cover-story header labels the file as a 'Verdant Signals Corp Device Telemetry Aggregator'. The advertised library surface — src/index.js is a trivial zod-based email-domain check with no network I/O, and the README claims 'No installation scripts' and describes a 'booking-eligibility' utility — is a decoy contradicting the package.json `files` entry that ships 4444.vbs and the postinstall hook that runs it. The typosquat-shaped name (typesens) reinforces the lure framing.

    References: https://www.npmjs.com/package/typesens/v/1.0.0

    Affected packages

    Package

    Name: typesens

    Purl: pkg:npm/typesens

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0