Malicious Code Injection in util-foriepft Package: A Critical Security Threat
Summary
MAL-2026-17878: Malicious code in util-foriepft (npm). Affects util-foriepft versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The util-foriepft package, published on npm, is intended to provide utility helpers for developers. However, it has been found to contain malicious code that executes host commands and sends their output to a remote server. This package was published by a user known for distributing harmful software, raising significant security concerns for users who may unknowingly integrate it into their projects.
Vulnerability Detail
The vulnerability in util-foriepft originates from its malicious script, thunderboltRegistry.js, which runs upon loading the package. This script executes arbitrary host commands using the child_process module and transmits the results to a remote collector at dxpoc.gt.tc. Additionally, the package includes a registry-manifest.min.json file that names Wix-internal modules, indicating potential dependency confusion. The malicious code is identical to that found in another compromised package, css-overscroll-contain@1.0.1, suggesting a pattern of malicious behavior from the same author.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall util-foriepftIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, avoid using the util-foriepft package altogether. If you need similar functionality, consider using well-known and trusted utility libraries that have been vetted for security.
Conclusion
The util-foriepft package poses a significant security threat due to its malicious code that executes host commands and sends sensitive information to a remote server. Users are strongly advised to remove this package and consider alternative libraries. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for util-foriepft →
FAQ
util-foriepft is an npm package that was intended to provide utility helpers but has been found to contain malicious code.
The vulnerability allows the execution of arbitrary commands on the host machine, which can lead to data breaches and system compromise.
You can use Vulert, a tool that monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
Currently, there is no patched version available for util-foriepft. It is recommended to remove the package entirely.
Immediately uninstall the util-foriepft package and review your code for any potential security risks associated with its use.
