{
  "modified": "2026-10-11T14:00:00Z",
  "schema_version": "1.7.4",
  "id": "MAL-2026-17878",
  "summary": "Malicious code in util-foriepft (npm)",
  "details": "util-foriepft@1.0.0 was published to npm on 2026-10-08 17:34 UTC by user regex33-hackerone. It is described as utility helpers but ships no library code: index.js is an empty module. thunderboltRegistry.js runs when the package is loaded, executes host commands through child_process and sends their output to a remote collector at dxpoc[.]gt[.]tc, and registry-manifest.min.json names Wix-internal modules (dependency confusion). Apart from the collector URL, thunderboltRegistry.js is byte-identical to the payload of css-overscroll-contain@1.0.1 (MAL-2026-17705), published from the same account. The package was still available on 2026-10-11.",
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "util-foriepft"
      },
      "versions": [
        "1.0.0"
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://osv.dev/vulnerability/MAL-2026-17705"
    }
  ],
  "credits": [
    {
      "name": "Eunsoo Kim",
      "type": "FINDER",
      "contact": [
        "https://github.com/eskim86"
      ]
    }
  ],
  "database_specific": {
    "iocs": {
      "domains": [
        "dxpoc.gt.tc"
      ],
      "files": [
        {
          "digests": {
            "sha256": "0bebf66b8f89240b99cbe6dadc92023156e6155740e272d3e7a43aa138b8b675"
          },
          "note": "payload: runs on require, executes host commands and sends their output to the collector; same file as in css-overscroll-contain@1.0.1 except for the collector URL",
          "paths": [
            "thunderboltRegistry.js"
          ],
          "source": "PACKAGE_ARCHIVE"
        },
        {
          "digests": {
            "sha256": "c8e3101a375550ae7559c94b2720f81dc63cac44c4c8aace17211e5eed71751d"
          },
          "note": "manifest naming Wix-internal modules (dependency confusion)",
          "paths": [
            "registry-manifest.min.json"
          ],
          "source": "PACKAGE_ARCHIVE"
        }
      ]
    }
  }
}