# MAL-2026-17546: Malicious code in aria-live-region-helper (npm)


- **Type:** Malicious package
- **Package:** `aria-live-region-helper` (npm)
- **Published:** 5 Oct 2026

## What is MAL-2026-17546?

MAL-2026-17546 is a malicious package in aria-live-region-helper, published on 5 Oct 2026. 

### Official description

The package is advertised as an ARIA accessibility helper but ships thunderboltRegistry.js, which executes a top-level IIFE on module load. The IIFE runs shell reconnaissance commands via child_process.execSync (whoami, id, pwd, ifconfig/ip addr, cat /etc/hosts, hostname) and sends their output, together with a beacon containing Node version, process.platform, and PID, via HTTP GET requests to the hardcoded endpoint http://dxpoc.gt.tc/callback.php/ef9ea0e191006f3cc6670720c99c26f3. The package also exports factories under names matching internal Wix thunderbolt registry entry points (thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry, etc.) and includes a registry-manifest.min.json mapping those names to parastorage.com unpkg URLs, so that a build pipeline resolving any of those registry names to this package triggers the recon-exfiltration side effect on import. Neither the reconnaissance behavior nor the dxpoc.gt.tc destination is related to the package's advertised accessibility purpose.

## What should I do about MAL-2026-17546?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-17546 is a malicious package: aria-live-region-helper (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-17546/ (Markdown: https://insights.sbomify.com/MAL-2026-17546/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-17546

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-17546/
Summaries are generated and may contain mistakes; the official description above is the record.