agency-testts

GHSA-75mh-8gwp-9cvf

Malicious code in agency-testts (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (ac3bbe97b41f8d8d1a74e9f369318620c08d648365a4e78d49d1da31d085531d)
package.json declares a postinstall lifecycle hook `wscript.exe 4444.vbs` that auto-runs on `npm install` on Windows. The bundled 4444.vbs is a ~674KB script containing large opaque base64 blobs and an AES key/IV pair (`stateFKK`, `manifestGCP`) which it uses at runtime to decrypt an embedded payload via `CreateDecryptor().TransformFinalBlock` and hand it to `C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe` for execution. After staging, the script self-cleans with `cmd.exe /c ping 127.0.0.1 -n 8 >nul & del /f /q... & rmdir /s /q...` to remove its own artifacts. Cover-story comments label the script a `Sync Agent — diagnostic telemetry collector` from a fictitious `Wingtip Toys Corporation`, but the code performs no telemetry-shaped behavior — it decrypts and executes an opaque payload. The package ships no other functionality; installing it on Windows results in arbitrary attacker code running under the installer's user account.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/c93fda3f08313c598165839b4fb8b4d4d912f27a/osv/malicious/npm/agency-testts/MAL-2026-17171.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/c93fda3f08313c598165839b4fb8b4d4d912f27a/osv/malicious/npm/agency-testts/MAL-2026-17171.json
- https://www.npmjs.com/package/agency-testts/v/1.0.0
- https://github.com/advisories/GHSA-75mh-8gwp-9cvf

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.