util-foriepft

GHSA-jc4x-j69j-jf5c

Malicious code in util-foriepft (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

[email protected] was published to npm on 2026-10-08 17:34 UTC by user regex33-hackerone. It is described as utility helpers but ships no library code: index.js is an empty module. thunderboltRegistry.js runs when the package is loaded, executes host commands through child_process and sends their output to a remote collector at dxpoc[.]gt[.]tc, and registry-manifest.min.json names Wix-internal modules (dependency confusion). Apart from the collector URL, thunderboltRegistry.js is byte-identical to the payload of [email protected] (MAL-2026-17705), published from the same account. The package was still available on 2026-10-11.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/f3a43bd1816c83b851bacecb8dabb5ddd8b9e10b/osv/malicious/npm/util-foriepft/MAL-2026-17878.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/f3a43bd1816c83b851bacecb8dabb5ddd8b9e10b/osv/malicious/npm/util-foriepft/MAL-2026-17878.json
- https://osv.dev/vulnerability/MAL-2026-17705
- https://github.com/advisories/GHSA-jc4x-j69j-jf5c

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.