The celonix-otp-react package masquerades as a React OTP component but hardcodes a Firebase Realtime Database URL controlled by the author. It silently sends users' phone numbers, OTP codes, and site origins to this backend. Authentication depends on a 'verified' flag set by the backend, which the author can manipulate to grant unauthorized access without cryptographic validation. This creates a backdoor allowing the author to impersonate any user on any site integrating this package. The package's advertised functionality is the attack vector, with no legitimate or benign usage. Installing or running this package compromises the host system, potentially exposing all stored secrets and keys.

Any site integrating this package unknowingly leaks sensitive user data (phone numbers and OTP codes) to the attacker-controlled backend. The attacker can bypass authentication controls on the consumer site by marking sessions as verified, enabling unauthorized access. Systems with this package installed are considered fully compromised, risking exposure of all stored secrets and credentials.

Remove the celonix-otp-react package immediately from all projects. Rotate all secrets and keys stored on affected systems from a secure, uncompromised environment. Treat any system with this package installed as potentially fully compromised and perform thorough incident response. There is no patch or safe configuration available for this package.