typesens

GHSA-mh5h-258m-rw22

Malicious code in typesens (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (3ded39f31b2c2d4d73e0b576ab862c9ed90688153a43c359dae5b26854ad8738)
package.json declares postinstall `wscript.exe 4444.vbs`, which runs automatically on `npm install`. The shipped 4444.vbs (~765 KB) contains a multi-layer decryption chain (AES S-box, ChaCha20-IETF, SHA-256 constants XOR-masked with 0x5A5A5A5A) over ~665 base64 chunks, decodes a payload to %TEMP% as a.dat file, drops a PowerShell loader, and invokes powershell.exe to perform process hollowing on Windows. Function names in the VBS are randomized (PlatformProbeLVI, DeviceCatalogUBYQ, EndpointRegistryRFX) and the `CreateObject` target is XOR-decoded at runtime; a cover-story header labels the file as a 'Verdant Signals Corp Device Telemetry Aggregator'. The advertised library surface — src/index.js is a trivial zod-based email-domain check with no network I/O, and the README claims 'No installation scripts' and describes a 'booking-eligibility' utility — is a decoy contradicting the package.json `files` entry that ships 4444.vbs and the postinstall hook that runs it. The typosquat-shaped name (typesens) reinforces the lure framing.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/28e8e300c79177f2cb1eb131ae981c3c0e639495/osv/malicious/npm/typesens/MAL-2026-17565.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/28e8e300c79177f2cb1eb131ae981c3c0e639495/osv/malicious/npm/typesens/MAL-2026-17565.json
- https://www.npmjs.com/package/typesens/v/1.0.0
- https://github.com/advisories/GHSA-mh5h-258m-rw22

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.