Malicious code in @bx-ui-framework/microfrontend (npm)

The @bx-ui-framework/microfrontend package version 15.0.0 includes a runtime dependency that points to a bare HTTPS URL outside the official npm registry. This URL hosts a tarball that can change at any time without version or hash verification, enabling the execution of potentially malicious lifecycle scripts and code during npm install. The domain hosting the tarball is unrelated to any known or trusted publisher for this package scope, indicating a supply chain risk through untrusted code execution.

Users installing version 15.0.0 of @bx-ui-framework/microfrontend may inadvertently execute arbitrary and potentially malicious code from an untrusted source during dependency installation. This can lead to compromise of the build environment or systems where the package is installed. No known exploits in the wild have been reported at this time.

No official patch or remediation is currently documented. Users should avoid installing version 15.0.0 of @bx-ui-framework/microfrontend due to the untrusted dependency source. Verify dependencies to ensure all packages are fetched from trusted registries with proper version and integrity checks. Monitor vendor advisories for updates or official fixes.