Malicious code in analytics-web-client (npm)

The 'analytics-web-client' npm package version 30.0.0 declares a dependency on itself via a bare HTTPS URL (https://repo.securityctrl.com/analytics-web-client) instead of a versioned registry range. This dependency-confusion style attack allows npm to fetch and execute arbitrary code from the external URL during installation lifecycle scripts without integrity verification. The shipped index.js is inert, indicating the malicious behavior is embedded in the dependency resolution and install process. Control of the external host equates to control over code executed on the installer's machine at install time, leading to full system compromise.

Any computer with this package installed or running is considered fully compromised. Attackers potentially gain full control of the system, including access to all stored secrets and keys. Immediate rotation of all credentials from a separate, uncompromised system is required. Removing the package does not guarantee removal of all malicious artifacts or backdoors introduced during installation.

No official fix or patch is indicated. The primary mitigation is to remove the 'analytics-web-client' package version 30.0.0 immediately. All secrets and keys on affected systems must be rotated from a different, trusted machine. Because the package enables full system compromise, consider rebuilding or thoroughly cleaning affected systems. Monitor for any signs of persistent compromise. Patch status is not yet confirmed — check vendor advisories or trusted sources for updates.