MAL-2026-17565 Malicious code in typesens (npm)

package.json declares postinstall wscript.exe 4444.vbs, which runs automatically on npm install. The shipped 4444.vbs (~765 KB) contains a multi-layer decryption chain (AES S-box, ChaCha20-IETF, SHA-256 constants XOR-masked with 0x5A5A5A5A) over ~665 base64 chunks, decodes a payload to %TEMP% as a.dat file, drops a PowerShell loader, and invokes powershell.exe to perform process hollowing on Windows. Function names in the VBS are randomized (PlatformProbeLVI, DeviceCatalogUBYQ, EndpointRegistryRFX) and the CreateObject target is XOR-decoded at runtime; a cover-story header labels the file as a 'Verdant Signals Corp Device Telemetry Aggregator'. The advertised library surface — src/index.js is a trivial zod-based email-domain check with no network I/O, and the README claims 'No installation scripts' and describes a 'booking-eligibility' utility — is a decoy contradicting the package.json files entry that ships 4444.vbs and the postinstall hook that runs it. The typosquat-shaped name (typesens) reinforces the lure framing.