Malicious code in amplitude-react-native (npm)

The amplitude-react-native npm package version 45.0.0 declares a dependency whose source is a bare HTTPS URL (https://repo.securityctrl.com/amplitude-react-native) instead of a versioned registry range. This dependency key matches the package's own name, creating a dependency-confusion vulnerability. When npm installs the package, it fetches and executes any lifecycle scripts from the remote tarball controlled by the attacker. Although the shipped index.js is inert, the manifest itself enables arbitrary code execution on the installer's machine. This results in full compromise of any system installing this package version.

Systems installing amplitude-react-native version 45.0.0 are fully compromised due to arbitrary code execution from malicious lifecycle scripts fetched from an attacker-controlled URL. Attackers gain full control over the affected machine, potentially accessing all stored secrets and keys. Removal of the package does not guarantee eradication of all malicious software installed as a result. Immediate rotation of all secrets and keys from a separate, uncompromised system is required.

No official patch or fix is currently documented. Immediate removal of amplitude-react-native version 45.0.0 is strongly recommended. Treat any system with this package installed as fully compromised. Rotate all secrets and keys from a different, secure machine. Monitor for any signs of persistent compromise. Check for vendor advisories or updates for official remediation guidance.