GCVE-110-OSM-2026-12666

package.json declares a postinstall hook `wscript.exe 4444.vbs` that fires automatically on `npm install`. The shipped 4444.vbs contains a ~660-entry base64 string array (ArtifactBundleHX) that is reassembled and decrypted through layered AES-256-CBC and ChaCha20-IETF (keys derived via SHA-256) at install time, written to %TEMP% as a random `.dat` file, and passed to powershell.exe as a two-tier loader for in-memory execution / process hollowing. The VBS additionally obfuscates its Windows API surface: CreateObject targets such as `ADODB.Stream` and `Msxml2.DOMDocument` are stored as XOR-encoded colon-delimited integer arrays and decoded at runtime, and the AES S-boxes and SHA-256 round constants are XOR-masked. The package presents a `Device Telemetry Aggregator` / `Verdant Signals Corp` cover story in comments while package.json ships empty author and description fields. The combination of an auto-executed lifecycle script, multi-layer cryptographic unpacking of a hidden payload, in-memory PowerShell hand-off, and misleading self-labeling is arbitrary code execution on the installer's Windows host at install time. ENTRY - Postinstall Script in package.json: ""postinstall": "wscript.exe 4444.vbs"" 1. `wscript.exe` executes `4444.vbs`. 2. The VBS decrypts embedded PowerShell using AES-256-CBC, ChaCha20, and an RC4-derived byte transformation. 3. It writes randomized files matching `pf<random>.dat`, `rf<random>.dat`, and `ld<random>.ps1`, plus a `dep<random>` directory. 4. It invokes hidden PowerShell at `C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe` with `-NoProfile -WindowStyle Hidden`, sets `PSExecut ionPolicyPreference=Bypass`, and executes the loader with `iex`. 5. The PowerShell loader decodes, decrypts, and gzip-decompresses the embedded managed DLL and native PE. 6. The managed component uses a suspended `InstallUtil.exe` target and transfers execution to the embedded native payload. 7. The loader removes temporary artifacts. The recovered PowerShell also implements a ten-minute watchdog timer. No active persistence mechanism was found. The VBS contains only a comment referring to an optional scheduled-task hook. No C2 endpoints, URLs, doma ins, IP addresses, sockets, downloads, data collection, or exfiltration logic was identified in the VBS or recovered PowerShell.