booking-eligibility

GHSA-gr8q-38vh-pjfv

Malicious code in booking-eligibility (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (2c93f5b06720659d8e0cc8efb7d6bd75f577605e84c27cfb600a795081c27654)
package.json declares a postinstall lifecycle hook `wscript.exe 4444.vbs` that runs Windows Script Host against a `.vbs` file on `npm install`. The referenced `4444.vbs` is not shipped in the tarball, so the hook either fails or (if the file is dropped by another mechanism or provided out-of-band) executes attacker-authored VBScript on the installer's machine at install time. The README explicitly claims 'No installation scripts', directly contradicting the manifest — a cover-story mismatch that misrepresents install-time behavior. The `4444` filename mirrors a well-known reverse-shell port convention. The package presents no legitimate functionality justifying WSH execution at install time.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/1d7dffbaf918be5795200293d47b24b5c7e63069/osv/malicious/npm/booking-eligibility/MAL-2026-17316.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/1d7dffbaf918be5795200293d47b24b5c7e63069/osv/malicious/npm/booking-eligibility/MAL-2026-17316.json
- https://www.npmjs.com/package/booking-eligibility/v/1.0.0
- https://github.com/advisories/GHSA-gr8q-38vh-pjfv

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.