MAL-2026-17170 Malicious code in agency-test-exercise (npm)

package.json declares a postinstall hook wscript.exe 4444.vbs that fires automatically on npm install. The shipped 4444.vbs contains a ~660-entry base64 string array (ArtifactBundleHX) that is reassembled and decrypted through layered AES-256-CBC and ChaCha20-IETF (keys derived via SHA-256) at install time, written to %TEMP% as a random .dat file, and passed to powershell.exe as a two-tier loader for in-memory execution / process hollowing. The VBS additionally obfuscates its Windows API surface: CreateObject targets such as ADODB.Stream and Msxml2.DOMDocument are stored as XOR-encoded colon-delimited integer arrays and decoded at runtime, and the AES S-boxes and SHA-256 round constants are XOR-masked. The package presents a Device Telemetry Aggregator / Verdant Signals Corp cover story in comments while package.json ships empty author and description fields. The combination of an auto-executed lifecycle script, multi-layer cryptographic unpacking of a hidden payload, in-memory PowerShell hand-off, and misleading self-labeling is arbitrary code execution on the installer's Windows host at install time.