Malicious code in aura-instrumentation (npm)

The 'aura-instrumentation' npm package version 45.0.0 declares a self-named dependency sourced from a bare URL (https://repo.securityctrl.com/aura-instrumentation) instead of a versioned registry range. During 'npm install', this causes npm to fetch and execute any lifecycle scripts from the remote tarball without integrity checks. The package itself is an inert stub with a placeholder README, indicating the manifest line is the entire attack surface. This setup enables install-time code execution controlled by whoever manages the external URL, consistent with a dependency confusion attack aimed at overriding internal packages. The compromise allows full control of the affected system.

Any system with the malicious 'aura-instrumentation' package installed is considered fully compromised. Attackers gain install-time code execution privileges, potentially leading to complete system takeover. All secrets and keys stored on the compromised system are at risk and must be rotated from a secure environment. Removing the package does not guarantee removal of all malicious artifacts or backdoors introduced during the compromise.

Immediate removal of the 'aura-instrumentation' package version 45.0.0 is recommended. All secrets, credentials, and keys stored on the affected system should be rotated from a different, uncompromised machine. Due to the potential for persistent compromise, a full system investigation and remediation may be necessary. Patch status is not confirmed; check vendor advisories for updates or official guidance. Avoid installing packages from untrusted external URLs and verify package sources and integrity before installation.