Malicious Code Execution Vulnerability in agency-test-exercise Package
Summary
MAL-2026-17170: Malicious code in agency-test-exercise (npm). Affects agency-test-exercise versions 1.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The agency-test-exercise package is an npm module designed for testing and development purposes. It is intended to facilitate various exercises within a controlled environment. However, this package has been compromised, embedding malicious code that poses significant security risks to users who install it.
Vulnerability Detail
The vulnerability stems from a postinstall hook in the package.json file that executes a malicious script (4444.vbs) during the npm install process. This script contains a large base64-encoded payload that is decrypted and executed in memory, allowing arbitrary code execution on the installer's Windows host. The malicious code obfuscates its operations, making it difficult to detect and analyze. The potential ramifications include unauthorized access to the system, data exfiltration, and installation of additional malware.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall agency-test-exerciseIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid installing the agency-test-exercise package until a secure version is available. If you have already installed it, remove it from your project using: npm uninstall agency-test-exercise.
Conclusion
The agency-test-exercise package contains a severe vulnerability that allows for malicious code execution on the installer's system. Users are advised to uninstall the package and monitor for updates or patches. Utilizing tools like Vulert can help in identifying such vulnerabilities in real-time.
See every vulnerability recorded for agency-test-exercise →
FAQ
It is an npm module intended for testing and development exercises, but it has been compromised with malicious code.
The malicious code executes through a postinstall hook that runs a VBS script during the npm install process.
The risks include unauthorized access to the system, potential data theft, and the installation of additional malicious software.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
Immediately uninstall the package using the command: npm uninstall agency-test-exercise, and monitor your system for any unusual activity.
