util-foriepft

{"schema_version":"1.7.4","id":"MAL-2026-17878","published":"2026-10-26T01:34:10Z","modified":"2026-10-26T06:41:39.676009804Z","aliases":["GHSA-rc7p-6p9r-rfj9"],"summary":"Malicious code in util-foriepft (npm)","details":"util-foriepft@1.0.0 was published to npm on 2026-10-08 17:34 UTC by user regex33-hackerone. It is described as utility helpers but ships no library code: index.js is an empty module. thunderboltRegistry.js runs when the package is loaded, executes host commands through child_process and sends their output to a remote collector at dxpoc[.]gt[.]tc, and registry-manifest.min.json names Wix-internal modules (dependency confusion). Apart from the collector URL, thunderboltRegistry.js is byte-identical to the payload of css-overscroll-contain@1.0.1 (MAL-2026-17705), published from the same account. The package was still available on 2026-10-11.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7cc1472e822706a606e8f0c3a421d2896d6065174da6c7a2c4a2694a9e27b391)\nThe package's thunderboltRegistry.js imports child_process and https, invokes execSync and uname to collect host identifiers (hostname, uname output, and other system info), and uses https.get to send that data to an external host. The flagged file combines process spawning of system-info commands with an outbound HTTPS request carrying the collected identifiers, matching the shape of a reconnaissance beacon rather than any documented utility behavior. The package name does not describe this functionality, and the module has no legitimate utility purpose that would require collecting and transmitting system identifiers off-host.\n\n## Source: ghsa-malware (7783f52b25db6868f9cf0d1f2bf1add038bb62b4c34bb57b0b7977cf2d2feebc)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"util-foriepft","ecosystem":"npm"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"thunderboltRegistry.js","sha256":"0bebf66b8f89240b99cbe6dadc92023156e6155740e272d3e7a43aa138b8b675","tlsh":"2de1a5a474ece41071a334b4bbbfa44bbbb798171d69b99070c485b41fb00bc51a9df6"}]}}}],"references":[{"type":"ADVISORY","url":"https://osv.dev/vulnerability/MAL-2026-17705"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-rc7p-6p9r-rfj9"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/util-foriepft/v/1.0.0"}],"database_specific":{"iocs":{"domains":["dxpoc.gt.tc"],"files":[{"digests":{"sha256":"0bebf66b8f89240b99cbe6dadc92023156e6155740e272d3e7a43aa138b8b675"},"note":"payload: runs on require, executes host commands and sends their output to the collector; same file as in css-overscroll-contain@1.0.1 except for the collector URL","paths":["thunderboltRegistry.js"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"c8e3101a375550ae7559c94b2720f81dc63cac44c4c8aace17211e5eed71751d"},"note":"manifest naming Wix-internal modules (dependency confusion)","paths":["registry-manifest.min.json"],"source":"PACKAGE_ARCHIVE"}]},"malicious-packages-origins":[{"id":"GHSA-rc7p-6p9r-rfj9","import_time":"2026-10-26T01:39:10.995566603Z","modified_time":"2026-10-26T01:34:18Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"7783f52b25db6868f9cf0d1f2bf1add038bb62b4c34bb57b0b7977cf2d2feebc","source":"ghsa-malware"},{"id":"IN-MAL-2026-021784","import_time":"2026-10-26T06:39:42.880593241Z","modified_time":"2026-10-26T06:32:20Z","sha256":"7cc1472e822706a606e8f0c3a421d2896d6065174da6c7a2c4a2694a9e27b391","source":"amazon-inspector","versions":["1.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Eunsoo Kim","contact":["https://github.com/eskim86"],"type":"FINDER"}]}