Malicious code in confluence-rest (npm)

The 'confluence-rest' npm package version 30.0.0 declares a self-referential dependency with the same package name but pointing to a bare HTTPS URL (https://repo.securityctrl.com/confluence-rest) instead of a semver range. During 'npm install', this URL is resolved and the tarball it returns is installed and executed, including any lifecycle scripts, without version pinning or integrity verification. The package's own index.js is inert, so the external URL is the sole source of executable code, effectively allowing whoever controls that URL to execute arbitrary code on the installer's machine. This dependency-confusion style attack targets internal package resolution mechanisms. The presence of this package indicates a full system compromise.

Systems with 'confluence-rest' version 30.0.0 installed are fully compromised, as arbitrary code execution occurs during installation from an untrusted external source. Attackers controlling the external URL can execute any code, potentially stealing secrets and keys. Removal of the package alone does not guarantee eradication of all malicious software introduced. Immediate rotation of all secrets and keys stored on the compromised system is required.

Remove the 'confluence-rest' package version 30.0.0 immediately. Rotate all secrets and keys from a different, uncompromised machine. Because full system compromise is likely, further forensic analysis and remediation may be necessary. Patch status is not confirmed; check vendor advisories for updates. No official fix or patch is currently documented.