CERT24MAL-2026-17878 — Malicious code in the util-foriepft npm packageLoading data…
CERT24Threat Observatory
Period

MAL-2026-17878 — Malicious code in the util-foriepft npm package

util-foriepft@1.0.0 was published to npm on 2026-10-08. It is described as a utility package but contains no library code: index.js is an empty module. When the package is loaded, thunderboltRegistry.js executes host commands through child_process and sends their output to a remote collector at dxpoc[.]gt[.]tc. registry-manifest.min.json names Wix-internal modules, which indicates dependency confusion. The package was still available on 2026-10-11.

← Back to intelligence

MAL-2026-17878 — Malicious code in the util-foriepft npm package

util-foriepft@1.0.0 was published to npm on 2026-10-08. It is described as a utility package but contains no library code: index.js is an empty module. When the package is loaded, thunderboltRegistry.js executes host commands through child_process and sends their output to a remote collector at dxpoc[.]gt[.]tc. registry-manifest.min.json names Wix-internal modules, which indicates dependency confusion. The package was still available on 2026-10-11.