# MAL-2026-17565: Malicious code in typesens (npm)


- **Type:** Malicious package
- **Package:** `typesens` (npm)
- **Published:** 5 Oct 2026

## What is MAL-2026-17565?

MAL-2026-17565 is a malicious package in typesens, published on 5 Oct 2026. 

### Official description

package.json declares postinstall `wscript.exe 4444.vbs`, which runs automatically on `npm install`. The shipped 4444.vbs (~765 KB) contains a multi-layer decryption chain (AES S-box, ChaCha20-IETF, SHA-256 constants XOR-masked with 0x5A5A5A5A) over ~665 base64 chunks, decodes a payload to %TEMP% as a.dat file, drops a PowerShell loader, and invokes powershell.exe to perform process hollowing on Windows. Function names in the VBS are randomized (PlatformProbeLVI, DeviceCatalogUBYQ, EndpointRegistryRFX) and the `CreateObject` target is XOR-decoded at runtime; a cover-story header labels the file as a 'Verdant Signals Corp Device Telemetry Aggregator'. The advertised library surface — src/index.js is a trivial zod-based email-domain check with no network I/O, and the README claims 'No installation scripts' and describes a 'booking-eligibility' utility — is a decoy contradicting the package.json `files` entry that ships 4444.vbs and the postinstall hook that runs it. The typosquat-shaped name (typesens) reinforces the lure framing.

## What should I do about MAL-2026-17565?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-17565 is a malicious package: typesens (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-17565/ (Markdown: https://insights.sbomify.com/MAL-2026-17565/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-17565

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-17565/
Summaries are generated and may contain mistakes; the official description above is the record.