{"answers":{"affected":"1 open source package ship an affected version, including test-agency-assignment-02.","exploited":"There is no known exploitation of MAL-2026-17297 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-17297 is a malicious package in test-agency-assignment-02, published on 29 Sep 2026."},"fix_prompt":"MAL-2026-17297 is a malicious package: test-agency-assignment-02 (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-17297/ (Markdown: https://insights.sbomify.com/MAL-2026-17297/index.md)","id":"MAL-2026-17297","markdown":"https://insights.sbomify.com/MAL-2026-17297/index.md","name":"MAL-2026-17297","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The tarball contains only package.json and 4444.vbs; the declared main entry (index.js) is absent. package.json defines a postinstall script `wscript.exe 4444.vbs`, so on `npm install` on Windows the VBScript executes automatically. 4444.vbs is heavily obfuscated (colon-delimited XOR-encoded CreateObject strings, embedded AES S-box and ChaCha20-IETF routines, and 600+ base64 fragments reconstructed at runtime) and presents cover strings identifying itself as `Device Telemetry Aggregator / Verdant Signals Corp.`. It reconstructs an encrypted payload, writes it to %TEMP% as a `pf*.dat` file, and invokes powershell.exe to perform process hollowing of the decoded loader. The package ships no library code — its only reachable behavior is the install-time dropper.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in test-agency-assignment-02 (npm)","id":"MAL-2026-17297","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"test-agency-assignment-02","purl":"pkg:npm/test-agency-assignment-02","source":"MAL-2026-17297"}],"products":null,"published":"2026-09-29","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-17297/"}