Malicious code in amplitude-experiment (npm)

The amplitude-experiment package at version 55.0.0 declares a dependency with the same name pointing to a non-registry HTTPS URL (https://repo.securityctrl.com/amplitude-experiment). During npm install, this URL is fetched without version pinning or integrity checks, allowing arbitrary code execution via lifecycle scripts in the fetched tarball. The legitimate amplitude-experiment package is an inert stub, making the dependency declaration the primary attack vector. This setup resembles a dependency confusion attack, leveraging an implausibly high version number to supersede legitimate versions. The compromise is severe enough that any system with this package installed should be treated as fully compromised.

Systems with [email protected] installed are fully compromised due to arbitrary code execution from malicious lifecycle scripts. Attackers may gain complete control over the affected system, potentially accessing all stored secrets and keys. Removal of the package alone does not guarantee eradication of the malicious presence, necessitating secret/key rotation from a secure environment.

Remove the [email protected] package immediately from all affected systems. Rotate all secrets and keys stored on compromised machines from a separate, secure system. Since the package installs malicious code via an external URL without integrity checks, avoid installing packages that declare dependencies from untrusted URLs. Monitor for any signs of persistent compromise and consider rebuilding affected systems to ensure full remediation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.