MAL-2026-17526

    Dashboard / Malicious Package / MAL-2026-17526

    MAL-2026-17526

    Published: 4 Oct 2026Last Modified: 4 Oct 2026

    Summary: Malicious code in tiny-dom-focus-trap (npm)

    Details: Source: amazon-inspector (84262096595a1e0ce09bbaa359930cd07cf420cc72545174ddc4f12c60bec962) The package is advertised as a focus-trap utility but thunderboltRegistry.js runs an IIFE at require time that uses child_process.execSync to run whoami, id, pwd, ifconfig / ip addr, hostname, and to read /etc/hosts, then sends each command's output as query parameters to http://dxpoc.gt.tc/callback.php via fetch. A separate beacon containing Node version, platform, and pid is also posted to the same endpoint. The package additionally impersonates Wix 'thunderbolt' internal registry module names (thunderboltRegistry, siteAssetsRegistry, documentManagementRegistry) and references static.parastorage.com manifest URLs, matching a dependency-confusion lure aimed at Wix build environments. Installing or importing this package causes the installer host's identity, network configuration, and /etc/hosts contents to be sent to an attacker-controlled host.

    References: https://www.npmjs.com/package/tiny-dom-focus-trap/v/1.0.0

    Affected packages

    Package

    Name: tiny-dom-focus-trap

    Purl: pkg:npm/tiny-dom-focus-trap

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0