# MAL-2026-17309: Malicious code in stestenv (npm)


- **Type:** Malicious package
- **Package:** `stestenv` (npm)
- **Published:** 30 Sep 2026

## What is MAL-2026-17309?

MAL-2026-17309 is a malicious package in stestenv, published on 30 Sep 2026. 

### Official description

On require of the package's main entry, `dispatchAnalytics()` reads a payload hidden in the JPEG APP13 (marker 0xFFED) segment of the bundled `dist/stest.jpg`, decrypts it with a hardcoded AES-256-CBC key to obtain a UTF-16LE PowerShell command, writes a VBScript to the OS tmpdir, and launches it via `wscript.exe` to run `powershell.exe -NoProfile -NonInteractive -EncodedCommand <payload>`. Runtime binary names are string-split (`"power"+"shell"`, `"wscript"+".exe"`) and the process is spawned detached with `windowsHide:true` and `.unref()` to evade lexical scanners and hide the window. A companion `dist/decode.js` confirms the encrypted PowerShell payload format (hardcoded 32-byte key, AES-256-CBC, UTF-16LE, re-base64 for `-EncodedCommand`). The bundled cli embeds an inlined `package.json` with a different identity (`name:"node-env-buffer", version:"2.2.6"`) than the published `stestenv` name, indicating the same dropper is being redistributed under multiple names while presenting a dotenv-style cover story. Installing or importing this package on Windows results in silent execution of attacker-controlled code hidden inside a shipped image asset.

## What should I do about MAL-2026-17309?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-17309 is a malicious package: stestenv (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-17309/ (Markdown: https://insights.sbomify.com/MAL-2026-17309/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-17309

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-17309/
Summaries are generated and may contain mistakes; the official description above is the record.