Malicious code in util-foriepft (npm)

{
  "id": "2c694f0257ef73c637dd8716acf058f3b8a5b15c1085a4bd0ceac1b74c43da03",
  "url": "https://osv.dev/vulnerability/MAL-2026-17878",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Malicious code in util-foriepft (npm)",
    "summary": "util-foriepft@1.0.0 was published to npm on 2026-10-08 17:34 UTC by user regex33-hackerone. It is described as utility helpers but ships no library code: index.js is an empty module. thunderboltRegistry.js runs when the package is loaded, executes host commands through child_process and sends their output to a remote collector at dxpoc[.]gt[.]tc, and registry-manifest.min.json names Wix-internal modules (dependency confusion). Apart from the collector URL, thunderboltRegistry.js is byte-identical to the payload of css-overscroll-contain@1.0.1 (MAL-2026-17705), published from the same account. The package was still available on 2026-10-11. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (7cc1472e822706a606e8f0c3a421d2896d6065174da6c7a2c4a2694a9e27b391) The package's thunderboltRegistry.js imports child_process and https, invokes execSync and uname to collect host identifiers (hostname, uname output, and other system info), and uses https.get to send that data to an external host. The flagged file combines process spawning of system-info commands with an outbound HTTPS request carrying the collected identifiers, matching the shape of a reconnaissance beacon rather than any documented utility behavior. The package name does not describe this functionality, and the module has no legitimate utility purpose that would require collecting and transmitting system identifiers off-host. ## Source: ghsa-malware (7783f52b25db6868f9cf0d1f2bf1add038bb",
    "evidence": "osv:MAL-2026-17878",
    "products": [
      {
        "name": {
          "value": "util-foriepft",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "1.0.0",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MAL-2026-17878",
      "aliases": [
        "GHSA-rc7p-6p9r-rfj9",
        "MAL-2026-17878"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                }
              ]
            }
          ],
          "package": {
            "name": "util-foriepft",
            "purl": "pkg:npm/util-foriepft",
            "ecosystem": "npm"
          },
          "versions": [
            "1.0.0"
          ],
          "database_specific": {
            "cwes": [
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              }
            ],
            "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/util-foriepft/MAL-2026-17878.json",
            "indicators": {
              "evidence_files": [
                {
                  "path": "thunderboltRegistry.js",
                  "tlsh": "2de1a5a474ece41071a334b4bbbfa44bbbb798171d69b99070c485b41fb00bc51a9df6",
                  "sha256": "0bebf66b8f89240b99cbe6dadc92023156e6155740e272d3e7a43aa138b8b675"
                }
              ]
            }
          }
        }
      ],
      "modified": "2026-10-26T06:45:15.031055980Z",
      "provider": "osv",
      "references": [
        "https://osv.dev/vulnerability/MAL-2026-17705",
        "https://github.com/advisories/GHSA-rc7p-6p9r-rfj9",
        "https://www.npmjs.com/package/util-foriepft/v/1.0.0"
      ],
      "provider_metadata": {
        "iocs": {
          "files": [
            {
              "note": "payload: runs on require, executes host commands and sends their output to the collector; same file as in css-overscroll-contain@1.0.1 except for the collector URL",
              "paths": [
                "thunderboltRegistry.js"
              ],
              "source": "PACKAGE_ARCHIVE",
              "digests": {
                "sha256": "0bebf66b8f89240b99cbe6dadc92023156e6155740e272d3e7a43aa138b8b675"
              }
            },
            {
              "note": "manifest naming Wix-internal modules (dependency confusion)",
              "paths": [
                "registry-manifest.min.json"
              ],
              "source": "PACKAGE_ARCHIVE",
              "digests": {
                "sha256": "c8e3101a375550ae7559c94b2720f81dc63cac44c4c8aace17211e5eed71751d"
              }
            }
          ],
          "domains": [
            "dxpoc.gt.tc"
          ]
        },
        "malicious-packages-origins": [
          {
            "id": "GHSA-rc7p-6p9r-rfj9",
            "ranges": [
              {
                "type": "SEMVER",
                "events": [
                  {
                    "introduced": "0"
                  }
                ]
              }
            ],
            "sha256": "7783f52b25db6868f9cf0d1f2bf1add038bb62b4c34bb57b0b7977cf2d2feebc",
            "source": "ghsa-malware",
            "import_time": "2026-10-26T01:39:10.995566603Z",
            "modified_time": "2026-10-26T01:34:18Z"
          },
          {
            "id": "IN-MAL-2026-021784",
            "sha256": "7cc1472e822706a606e8f0c3a421d2896d6065174da6c7a2c4a2694a9e27b391",
            "source": "amazon-inspector",
            "versions": [
              "1.0.0"
            ],
            "import_time": "2026-10-26T06:39:42.880593241Z",
            "modified_time": "2026-10-26T06:32:20Z"
          }
        ]
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 446732,
  "published_at": "2026-10-26T01:34:10+00:00"
}