Malicious code in @bx-ui-framework/authentication (npm)

The @bx-ui-framework/authentication npm package versions 1.2.0 and 15.0.0 include a runtime dependency declared as a bare HTTPS URL pointing to an external repository (https://repo.artifactorymanager.com/bx-ui-framework/authentication) instead of a versioned package from the npm registry. This allows the dependency to deliver arbitrary code controlled by the external host operator, bypassing npm's usual security mechanisms such as version pinning, integrity checks, and signature verification. The shipped package itself is minimal, making the external dependency the primary installable payload. The dependency key 'microfrontend' does not match the package name, and the external domain is unrelated to the npm scope publisher, indicating a high risk of supply chain compromise or malicious code injection.

Users installing affected versions of @bx-ui-framework/authentication may unknowingly execute arbitrary code controlled by the operator of the external repository during npm install. This can lead to supply chain compromise, allowing attackers to run malicious lifecycle scripts, potentially leading to code execution, data compromise, or further system compromise depending on the environment where the package is installed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or update is available, users should avoid installing the affected versions 1.2.0 and 15.0.0 of @bx-ui-framework/authentication. Review and audit dependencies declared as URLs rather than official registry versions. Consider using package lock files and integrity verification mechanisms to prevent untrusted code execution. Monitor vendor channels for updates or official patches addressing this issue.