Malicious Code Injection in studiocode_tools: A Critical Security Threat
Summary
MAL-2026-17523: Malicious code in studiocode_tools (npm). Affects studiocode_tools versions 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
studiocode_tools is an npm package designed for various development tools and utilities. It is commonly used in JavaScript projects to streamline workflows. However, this package has been compromised, leading to a significant security vulnerability that can execute malicious code on users' systems during installation.
Vulnerability Detail
The vulnerability originates from a postinstall hook defined in the package.json file of studiocode_tools, which executes a malicious VBS script (4444.vbs) upon installation on Windows systems. This script employs custom cryptography to obfuscate its true intent, ultimately leading to the execution of a PowerShell loader that can download and execute further malicious payloads. The presence of misleading branding and a false README statement denying installation scripts further indicates malicious intent.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall studiocode_toolsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid installing the studiocode_tools package until a secure version is released. Additionally, consider using a different package that provides similar functionality without the associated risks.
Conclusion
The studiocode_tools package has been identified as containing malicious code that poses a significant security risk. Users are advised to take immediate action to mitigate this threat by updating or removing the package and monitoring their systems for any signs of compromise.
See every vulnerability recorded for studiocode_tools →
FAQ
The vulnerability involves the execution of malicious code through a postinstall hook that runs a VBS script, which can lead to further exploitation of the system.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By utilizing the Vulert playground, you can check if your application is affected without any signup.
If you have installed the package, it is crucial to remove it immediately and update to a secure version once available.
Look for unexpected files in the %TEMP% directory, particularly those with names like pfNNNNN.dat, and monitor for unusual PowerShell activity.
The consequences can include unauthorized access to your system, data theft, and the installation of additional malicious software.
