{"id":"MAL-2026-17878","revision":"b481199aef174ea9aef03a6e254d8eb5","records":[{"revision":"b481199aef174ea9aef03a6e254d8eb5","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17878","aliases":[],"title":"Malicious code in util-foriepft (npm)","description":"util-foriepft@1.0.0 was published to npm on 2026-10-08 17:34 UTC by user regex33-hackerone. It is described as utility helpers but ships no library code: index.js is an empty module. thunderboltRegistry.js runs when the package is loaded, executes host commands through child_process and sends their output to a remote collector at dxpoc[.]gt[.]tc, and registry-manifest.min.json names Wix-internal modules (dependency confusion). Apart from the collector URL, thunderboltRegistry.js is byte-identical to the payload of css-overscroll-contain@1.0.1 (MAL-2026-17705), published from the same account. The package was still available on 2026-10-11.","state":0,"publishedAt":"2026-10-11T14:00:00+00:00","modifiedAt":"2026-10-15T03:45:04.8821613+00:00","affected":[{"ecosystem":"npm","name":"util-foriepft","ranges":[],"versions":["1.0.0"],"rawVersionEvidence":null}],"metrics":[],"references":["https://osv.dev/vulnerability/MAL-2026-17705"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17878","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17878","identifiers":["MAL-2026-17878"]},"retained":false,"historicalAffected":[]}],"coverage":[]}