{"id":"MAL-2026-17878","summary":"Malicious code in util-foriepft (npm)","details":"util-foriepft@1.0.0 was published to npm on 2026-10-08 17:34 UTC by user regex33-hackerone. It is described as utility helpers but ships no library code: index.js is an empty module. thunderboltRegistry.js runs when the package is loaded, executes host commands through child_process and sends their output to a remote collector at dxpoc[.]gt[.]tc, and registry-manifest.min.json names Wix-internal modules (dependency confusion). Apart from the collector URL, thunderboltRegistry.js is byte-identical to the payload of css-overscroll-contain@1.0.1 (MAL-2026-17705), published from the same account. The package was still available on 2026-10-11.","modified":"2026-10-15T03:45:04.882161347Z","published":"2026-10-11T14:00:00Z","database_specific":{"iocs":{"domains":["dxpoc.gt.tc"],"files":[{"digests":{"sha256":"0bebf66b8f89240b99cbe6dadc92023156e6155740e272d3e7a43aa138b8b675"},"note":"payload: runs on require, executes host commands and sends their output to the collector; same file as in css-overscroll-contain@1.0.1 except for the collector URL","paths":["thunderboltRegistry.js"],"source":"PACKAGE_ARCHIVE"},{"note":"manifest naming Wix-internal modules (dependency confusion)","paths":["registry-manifest.min.json"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"c8e3101a375550ae7559c94b2720f81dc63cac44c4c8aace17211e5eed71751d"}}]}},"references":[{"type":"ADVISORY","url":"https://osv.dev/vulnerability/MAL-2026-17705"}],"affected":[{"package":{"name":"util-foriepft","ecosystem":"npm","purl":"pkg:npm/util-foriepft"},"versions":["1.0.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/util-foriepft/MAL-2026-17878.json"}}],"schema_version":"1.9.0","credits":[{"name":"Eunsoo Kim","contact":["https://github.com/eskim86"],"type":"FINDER"}]}