Malicious code in @bx-ui-framework/common (npm)

The @bx-ui-framework/common npm package versions 1.2.0 and 15.0.0 include a dependency declaration where the dependency key equals the package name and the value is a bare HTTPS URL rather than a version range. During npm install, this causes npm to fetch and install code from the specified URL, executing any lifecycle scripts contained therein. The package's own code is inert, so the malicious payload is delivered entirely through this self-referential dependency pointing to an external repository controlled by an attacker. This dependency confusion allows arbitrary code execution on any system installing these package versions.

An attacker controlling the external repository at repo.remoteknight.com can execute arbitrary code on any machine that installs the affected versions of @bx-ui-framework/common. This can lead to compromise of the build or runtime environment of developers or CI systems using these package versions. The lack of version pinning, commit SHA, or integrity checks means the attacker can modify the payload at will, increasing risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid installing or updating to versions 1.2.0 and 15.0.0 of @bx-ui-framework/common. Consider auditing package.json files for self-referential dependencies with URL values and avoid packages that fetch code from untrusted external URLs. Use npm audit and supply integrity hashes where possible to detect or prevent such attacks.