Malicious code in axis-datagrid (npm)

The axis-datagrid package on npm version 45.0.0 declares a dependency with the same name as the package itself, but instead of a version range, it uses a bare HTTPS URL (https://repo.securityctrl.com/axis-datagrid) as the source. When npm installs this package, it fetches and executes code from this external URL without version pinning or integrity verification. The index.js file included is inert, indicating the install-time payload is delivered via the manifest dependency. This dependency-confusion style attack allows whoever controls the external repository to execute arbitrary code on the installer's machine. The package is designed to supersede internal package resolution and pull malicious code from an off-registry host.

Any system that installs or runs axis-datagrid version 45.0.0 is considered fully compromised. Attackers gain arbitrary code execution during installation, potentially leading to complete system takeover. All secrets and keys stored on the compromised system should be considered exposed and require immediate rotation. Removing the package does not guarantee removal of all malicious artifacts or backdoors introduced by the attacker.

Remove the axis-datagrid package version 45.0.0 immediately from all systems. Rotate all secrets and credentials that may have been exposed on compromised machines using a separate, trusted system. Avoid installing packages that declare dependencies from untrusted external URLs. Monitor for any signs of persistent compromise, as removal of the package alone may not eliminate all malicious code. Check for vendor advisories or updates for a fixed version before reinstalling.