{"items":[{"id":"NVI-00011057","kind":"supply_chain_event","title":"Malicious code in booking-tasks (npm)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-r7mc-qwv3-xpf9"],"plain_summary":"GitHub lists this malware advisory for booking-tasks. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-ae3613085bba08f7298112289ba415f7"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-ae3613085bba08f7298112289ba415f7","url":"https://github.com/advisories/GHSA-r7mc-qwv3-xpf9","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-r7mc-qwv3-xpf9","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T23:13:53.199Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-ae3613085bba08f7298112289ba415f7"],"technology":"booking-tasks","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (08305a6c73bd94f2983c949316cb78fef7f7169f85523a773c94fb305874e063)\nThe package's package.json declares a postinstall hook `wscript.exe 4444.vbs` that fires automatically on `npm install`. The bundled 4444.vbs contains hand-rolled AES-128 (with XOR-masked forward/inverse S-boxes), a ChaCha20-IETF stream, XOR-masked SHA-256 round constants, a Base64 decoder via MSXML DOM, and a chunked Base64 ciphertext blob (ArtifactBundleHX, ~665 chunks). At install time the VBScript decrypts these chunks into a PowerShell loader, writes it to %TEMP%\\pf.dat, and hands it to powershell.exe for process hollowing, giving the publisher arbitrary code execution on the installer's Windows host. The shipped library surface (src/index.js) is a small Zod-validated `checkEligibility()` function that never references 4444.vbs, and readme.md states 'No network requests. No personal data storage. No installation scripts.' — a direct contradiction of the declared postinstall hook, indicating the source module is a decoy for the dropper. The multi-primitive crypto and chunked-Base64 encoding of the payload serve only to hide executable content from static inspection.\n\n---\n\nCredit","public_affected_ranges":["= 1.0.2"]}],"null_published_at":"2026-10-31T23:18:22.427Z","source_updated_at":"2026-09-30T03:31:46.000Z","source_disclosed_at":"2026-09-30T03:31:45.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T23:13:53.199Z"}],"next_cursor":null,"snapshot_revision":"42594"}