Malicious code in confluence-create-content (npm)

The 'confluence-create-content' npm package version 30.0.0 is malicious because its package.json declares a self-named dependency with a bare HTTPS URL pointing to 'https://repo.securityctrl.com/confluence-create-content'. This causes npm to fetch and execute arbitrary code from this third-party URL during installation without version pinning or integrity verification. The local index.js is inert, so the actual malicious payload is delivered via this dependency URL. This setup also creates dependency confusion, as environments resolving this package name will pull code from the attacker-controlled host rather than the official npm registry.

Systems with this package installed are fully compromised, as the malicious payload executes arbitrary code with the privileges of the npm install process. All secrets and keys stored on the compromised system should be considered exposed and must be rotated immediately from a secure environment. Removing the package alone may not fully remediate the compromise since the attacker may have established persistent control.

Remove the 'confluence-create-content' package version 30.0.0 immediately from all affected systems. Rotate all secrets and keys that were stored or accessible on compromised systems from a secure, uncompromised environment. Because the package executes arbitrary code from an external source without integrity checks, do not trust any system that installed this package until fully cleaned and verified. Patch status is not applicable as this is a malicious package rather than a vulnerability with an official fix.