Critical Malicious Code Vulnerability in studiocode_eligibility Package
Summary
MAL-2026-17522: Malicious code in studiocode_eligibility (npm). Affects studiocode_eligibility versions 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The studiocode_eligibility package is an npm library designed to check the eligibility of email domains using Zod-based validation. It claims to run checks locally without network requests and does not include installation scripts. However, it has been found to contain a malicious postinstall hook that executes harmful code on Windows systems.
Vulnerability Detail
The vulnerability originates from a postinstall hook in the package.json file, which executes a VBScript (4444.vbs) upon installation. This script is obfuscated and contains code that decrypts a PowerShell loader, allowing arbitrary code execution on the installer's machine. This poses a significant security risk as it can lead to unauthorized access and control over the system.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall studiocode_eligibilityIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid installing the studiocode_eligibility package on Windows systems until a patched version is released. If you must use it, consider running it in a controlled environment such as a virtual machine or container to mitigate risks.
Conclusion
The studiocode_eligibility package contains a critical vulnerability that allows for the execution of malicious code on Windows systems. Users are advised to uninstall the package and monitor for updates. Utilizing tools like Vulert can help in identifying and managing such vulnerabilities effectively.
See every vulnerability recorded for studiocode_eligibility →
FAQ
The malicious code is embedded in a VBScript that executes upon installation, allowing for arbitrary code execution on the user's machine.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Uninstall the studiocode_eligibility package immediately and check for any updates or patches that address the vulnerability.
Yes, the malicious code is specifically designed to execute on Windows systems through the postinstall hook.
The consequences include unauthorized access to the system, potential data breaches, and the ability for attackers to execute arbitrary commands.
