MAL-2026-17878

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/util-foriepft/MAL-2026-17878.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-17878

Published

2026-10-11T14:00:00Z

Modified

2026-10-15T03:45:04Z

Summary

Malicious code in util-foriepft (npm)

Details

util-foriepft@1.0.0 was published to npm on 2026-10-08 17:34 UTC by user regex33-hackerone. It is described as utility helpers but ships no library code: index.js is an empty module. thunderboltRegistry.js runs when the package is loaded, executes host commands through child_process and sends their output to a remote collector at dxpoc[.]gt[.]tc, and registry-manifest.min.json names Wix-internal modules (dependency confusion). Apart from the collector URL, thunderboltRegistry.js is byte-identical to the payload of css-overscroll-contain@1.0.1 (MAL-2026-17705), published from the same account. The package was still available on 2026-10-11.

Database specific

{
    "iocs":  {
        "domains":  [
            "dxpoc.gt.tc"
        ],
        "files":  [
            {
                "digests":  {
                    "sha256":  "0bebf66b8f89240b99cbe6dadc92023156e6155740e272d3e7a43aa138b8b675"
                },
                "note":  "payload: runs on require, executes host commands and sends their output to the collector; same file as in css-overscroll-contain@1.0.1 except for the collector URL",
                "paths":  [
                    "thunderboltRegistry.js"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "c8e3101a375550ae7559c94b2720f81dc63cac44c4c8aace17211e5eed71751d"
                },
                "note":  "manifest naming Wix-internal modules (dependency confusion)",
                "paths":  [
                    "registry-manifest.min.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            }
        ]
    }
}

References

https://osv.dev/vulnerability/MAL-2026-17705

Credits

- Eunsoo Kim - FINDER
- - https://github.com/eskim86

Affected packages

npm / util-foriepft

Package

Name: util-foriepft; View open source insights on deps.dev
Purl: pkg:npm/util-foriepft

Affected ranges

Affected versions

1.*

1.0.0

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/util-foriepft/MAL-2026-17878.json"