Malicious code in alimama-minisite (npm)

The 'alimama-minisite' npm package version 45.0.0 is malicious. It declares a dependency with the same name as itself, but instead of a normal semver range from the npm registry, it points to an off-registry URL (https://repo.securityctrl.com/alimama-minisite). This causes npm install to fetch and execute arbitrary code from that URL without integrity verification. The high version number ensures this dependency wins resolution over any internal package of the same name. The package's index.js is inert, but the installation lifecycle scripts execute the malicious payload. This is a dependency confusion attack enabling arbitrary code execution on any system installing this package.

Systems that install this package version are fully compromised. The malicious lifecycle scripts executed during installation can lead to complete system takeover. All secrets and keys stored on the compromised system should be considered exposed and must be rotated from a separate, trusted system. Removing the package does not guarantee removal of all malicious artifacts or backdoors installed by the package.

No official patch or fix is available. The package should be removed immediately if installed. All secrets and keys on the affected system must be rotated from a different, uncompromised system. Due to the nature of the compromise, full system reimaging or restoration from a known good backup is recommended to ensure complete remediation.