If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (3ded39f31b2c2d4d73e0b576ab862c9ed90688153a43c359dae5b26854ad8738)
package.json declares postinstall `wscript.exe 4444.vbs`, which runs automatically on `npm install`. The shipped 4444.vbs (~765 KB) contains a multi-layer decryption chain (AES S-box, ChaCha20-IETF, SHA-256 constants XOR-masked with 0x5A5A5A5A) over ~665 base64 chunks, decodes a payload to %TEMP% as a.dat file, drops a PowerShell loader, and invokes powershell.exe to perform process hollowing on Windows. Function names in the VBS are randomized (PlatformProbeLVI, DeviceCatalogUBYQ, EndpointRegistryRFX) and the `CreateObject` target is XOR-decoded at runtime; a cover-story header labels the file as a 'Verdant Signals Corp Device Telemetry Aggregator'. The advertised library surface — src/index.js is a trivial zod-based email-domain check with no network I/O, and the README claims 'No installation scripts' and describes a 'booking-eligibility' utility — is a decoy contradicting the package.json `files` entry that ships 4444.vbs and the postinstall hook that runs it. The typosquat-shaped name (typesens) reinforces the lure framing.