Malicious code in amplitude-session-replay (npm)

The amplitude-session-replay npm package version 45.0.0 declares a dependency on itself using a plain HTTPS URL (https://repo.securityctrl.com/amplitude-session-replay) instead of a versioned registry entry. During npm install, this causes npm to fetch and execute code from the external URL, bypassing normal registry vetting and integrity checks. The published tarball is an inert stub, making the manifest the actual delivery mechanism for malicious code. Control of the external host equates to control over code executed on the installer's machine. This dependency-confusion style attack enables arbitrary code execution at install time, fully compromising affected systems.

Any system that installs or runs amplitude-session-replay version 45.0.0 is considered fully compromised. Attackers may gain complete control over the host, potentially accessing all stored secrets and keys. Removal of the package does not guarantee elimination of all malicious artifacts, as the attacker may have established persistent access or installed additional malware.

No official patch or fix is currently documented. Users should immediately remove the amplitude-session-replay package version 45.0.0 from their systems. All secrets and keys stored on compromised machines should be rotated from a separate, trusted device. Due to the severity of the compromise, affected systems should be thoroughly audited and potentially rebuilt to ensure removal of all malicious components.