Malicious code in calcite-web (npm)

The 'calcite-web' npm package version 45.0.0 is malicious because its package.json declares a dependency on itself via a bare URL (https://repo.securityctrl.com/calcite-web) instead of a versioned registry reference. During npm install, this causes npm to fetch and execute arbitrary code from that URL without version pinning or integrity checks. The actual shipped code is inert, but the install-time payload controlled by the external URL operator executes lifecycle scripts, effectively compromising the host system. This is a dependency confusion attack with an implausibly high version number to override legitimate internal packages.

Any computer with this package installed or running is considered fully compromised. Attackers controlling the external URL can execute arbitrary code with the privileges of the installer. All secrets and keys stored on the compromised system should be considered exposed and must be rotated immediately from a secure environment. Removing the package alone may not remove all malicious artifacts or backdoors installed by the attacker.

Remove the 'calcite-web' package version 45.0.0 immediately from all affected systems. Rotate all secrets, keys, and credentials that were stored or accessible on compromised machines from a different, secure computer. Because the attacker may have persistent access, consider a full system audit or rebuild. There is no official patch or fixed version indicated; avoid installing this package version or any that use external URL dependencies without integrity verification.