GCVE-110-OSM-2026-14062

util-foriepft@1.0.0 was published to npm on 2026-10-08 17:34 UTC by user regex33-hackerone. It is described as utility helpers but ships no library code: index.js is an empty module. thunderboltRegistry.js runs when the package is loaded, executes host commands through child_process and sends their output to a remote collector at dxpoc[.]gt[.]tc, and registry-manifest.min.json names Wix-internal modules (dependency confusion). Apart from the collector URL, thunderboltRegistry.js is byte-identical to the payload of css-overscroll-contain@1.0.1 (MAL-2026-17705), published from the same account. The package was still available on 2026-10-11. ENTRY index.js (main: index.js) DESTINATION - 3 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in thunderboltRegistry.js: "encodeURIComponent(tag) + "&d=" + encodeURIComponent(d.substring(0,3500)) + "&t=..." - Network Request in thunderboltRegistry.js: "https.get(" ADDITIONAL FINDINGS - Shell Command Execution in thunderboltRegistry.js: "require("child_process")" - Publisher Has Other Malicious Packages - Rapid Version Publishing PAYLOAD FILES thunderboltRegistry.js