MAL-2026-17878 Malicious code in util-foriepft (npm)

[email protected] was published to npm on 2026-10-08 17:34 UTC by user regex33-hackerone. It is described as utility helpers but ships no library code: index.js is an empty module. thunderboltRegistry.js runs when the package is loaded, executes host commands through child_process and sends their output to a remote collector at dxpoc[.]gt[.]tc, and registry-manifest.min.json names Wix-internal modules (dependency confusion). Apart from the collector URL, thunderboltRegistry.js is byte-identical to the payload of [email protected] (MAL-2026-17705), published from the same account. The package was still available on 2026-10-11.

The package's thunderboltRegistry.js imports child_process and https, invokes execSync and uname to collect host identifiers (hostname, uname output, and other system info), and uses https.get to send that data to an external host. The flagged file combines process spawning of system-info commands with an outbound HTTPS request carrying the collected identifiers, matching the shape of a reconnaissance beacon rather than any documented utility behavior. The package name does not describe this functionality, and the module has no legitimate utility purpose that would require collecting and transmitting system identifiers off-host.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.