MAL-2026-17503 Malicious code in dom-focus-sentinel (npm)
Malicious package
Published
MAL-2026-17503 is a malicious package: dom-focus-sentinel (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-17503/ (Markdown: https://insights.sbomify.com/MAL-2026-17503/index.md)
- Package
- dom-focus-sentinel
- Registry
- npm
What is MAL-2026-17503?
MAL-2026-17503 is a malicious package in dom-focus-sentinel, published on 4 Oct 2026.
Official description
thunderboltRegistry.js runs an immediately-invoked function at module load that uses child_process.execSync to run host reconnaissance commands (whoami, id, pwd, ifconfig, ip addr, cat /etc/hosts, hostname) and transmits each command's output, along with Node version, platform, and pid, via fetch GET requests to the hardcoded plain-HTTP endpoint http://dxpoc.gt.tc/callback.php/ef9ea0e191006f3cc6670720c99c26f3. The package also structurally impersonates Wix internal registry modules by exporting factories keyed on thunderboltRegistry/siteAssetsRegistry/documentManagementRegistry/editorRegistry/corvidRegistry and shipping a manifest with static.parastorage.com unpkg URLs under [email protected], so the exfiltration IIFE fires whenever a consumer requires any of these registry names. The reconnaissance behavior is unrelated to the declared focus-sentinel purpose, and a
beacon=rce-poc marker is embedded in the exfil traffic.What should I do about MAL-2026-17503?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.