Malicious code in confluence-editor (npm)

The confluence-editor npm package version 30.0.0 declares a dependency using a bare HTTPS URL (https://repo.securityctrl.com/confluence-editor) instead of a semver range from the npm registry. This dependency key matches the package's own name, indicating a dependency confusion attack vector. When installed, npm fetches the tarball from the external URL and executes any lifecycle scripts it contains without version pinning, integrity verification, or registry provenance. The package's local index.js is inert, so the attack surface is the manifest line itself, enabling remote code execution controlled by whoever manages the external repository. This leads to full system compromise on any machine where the package is installed.

Systems that have installed confluence-editor version 30.0.0 are fully compromised due to arbitrary code execution from an untrusted external source. Attackers can execute any code during installation, potentially stealing secrets, keys, or taking full control of the affected system. Removal of the package does not guarantee removal of all malicious artifacts, and all secrets and keys on the system should be rotated immediately from a trusted environment.

Remove the confluence-editor package version 30.0.0 immediately from all affected systems. Rotate all secrets and keys stored on compromised machines from a separate, trusted system. Since the malicious code is served dynamically from an external host, there is no official patch or fix available. Monitor for any signs of persistent compromise and consider rebuilding affected systems to ensure complete remediation.