Malicious code in bui-react-10themes (npm)

The 'bui-react-10themes' npm package version 45.0.0 uses a dependency confusion technique by declaring a dependency on itself with a bare HTTPS URL (https://repo.securityctrl.com/bui-react-10themes) rather than a version range or registry reference. This causes npm to fetch and install a tarball from an external, untrusted repository, executing any lifecycle scripts it contains. The shipped code in the package is inert, but the manifest edge triggers installation of potentially malicious code. This behavior can lead to full system compromise. The package should be removed, and all secrets and keys on the affected system rotated immediately.

Systems with 'bui-react-10themes' version 45.0.0 installed are fully compromised due to execution of malicious lifecycle scripts from an external source. Attackers may gain full control of the system, risking exposure of all stored secrets and keys. Removal of the package alone may not eliminate all malicious software installed as a result.

Remove the 'bui-react-10themes' package version 45.0.0 immediately from all affected systems. Rotate all secrets and keys stored on compromised systems from a separate, trusted device. Because the package executes arbitrary code during installation, assume full system compromise and conduct a thorough security assessment. No official patch or fix is indicated; remediation relies on removal and secret rotation.