Critical Malicious Code Vulnerability in dom-focus-sentinel Package
Summary
MAL-2026-17503: Malicious code in dom-focus-sentinel (npm). Affects dom-focus-sentinel versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dom-focus-sentinel package is an npm library designed to manage focus behavior in web applications. It is commonly used to enhance accessibility by ensuring that focus is appropriately managed within the DOM. However, this package has been found to contain malicious code that compromises the security of applications using it.
Vulnerability Detail
The vulnerability originates from the thunderboltRegistry.js file within the dom-focus-sentinel package. It executes an immediately-invoked function upon module loading that runs host reconnaissance commands such as whoami, id, pwd, ifconfig, and others. The output of these commands, along with the Node version, platform, and process ID, is sent to a hardcoded HTTP endpoint. This behavior is unrelated to the intended functionality of the package and poses significant security risks, including unauthorized data exfiltration.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall dom-focus-sentinelIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the dom-focus-sentinel package from your dependencies. This can be done by executing the following command: npm uninstall dom-focus-sentinel. Additionally, monitor your application for any suspicious activity until the vulnerability is resolved.
Conclusion
The dom-focus-sentinel package has a critical vulnerability due to embedded malicious code that executes unauthorized commands on the host system. It is essential to update or remove the package to mitigate risks associated with this vulnerability. Regular monitoring and using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for dom-focus-sentinel →
FAQ
The malicious code executes reconnaissance commands on the host system and sends the output to a remote server, compromising user data and system security.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If an immediate update is not possible, consider removing the package from your project and monitoring for any unusual behavior in your application.
Yes, the vulnerability can lead to unauthorized data exfiltration, which may result in data loss or compromise of sensitive information.
For more information, you can contact Amazon Inspector at inspector-research@amazon.com.
