{"items":[{"id":"NVI-00010957","kind":"supply_chain_event","title":"Malicious code in lite-mater (npm)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-294m-x97c-p7xh"],"plain_summary":"GitHub lists this malware advisory for lite-mater. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-733ed782b0e9a611f294f14ee8e54eab"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-733ed782b0e9a611f294f14ee8e54eab","url":"https://github.com/advisories/GHSA-294m-x97c-p7xh","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-294m-x97c-p7xh","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T23:13:24.290Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-733ed782b0e9a611f294f14ee8e54eab"],"technology":"lite-mater","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (532663c4102d3cf7310e29ca1eb2b389c5c32c1e541da219b7c4364968f4e807)\npackage.json declares a postinstall lifecycle hook `wscript.exe 4444.vbs` that runs automatically on `npm install` on Windows hosts. The shipped 4444.vbs (~765 KB) is a multi-layer obfuscated loader: an embedded payload is stored as a large ArtifactBundleHX[] string array, Base64-decoded via MSXML DOM into a byte buffer, then decrypted through a custom XOR routine, an AES forward S-box, and a ChaCha20-IETF stream layer. The reconstructed payload is written to %TEMP%\\pfNNNNN.dat and handed to powershell.exe via a two-tier loader whose in-source comments reference PowerShell process hollowing. Identifier and comment strings (`Device Telemetry Aggregator`, `Verdant Signals Corp`) act as a cover story, and the README explicitly claims the package has `No installation scripts` — directly contradicting the postinstall hook. The package ships no library code or legitimate functionality consistent with its stated purpose; its only install-time effect is to detonate the obfuscated Windows loader on the installer's machine.\n\n---\n\nCredit: OpenSSF ([sourc","public_affected_ranges":["= 1.0.0"]}],"null_published_at":"2026-10-31T23:18:22.413Z","source_updated_at":"2026-10-05T00:30:40.000Z","source_disclosed_at":"2026-10-05T00:30:38.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T23:13:24.290Z"}],"next_cursor":null,"snapshot_revision":"42594"}