Malicious code in css-import-order (npm)

The 'css-import-order' npm package version 1.1.0 is malicious due to its package.json configuration, which references its own package as a dependency and devDependency from a non-standard, plain HTTP URL outside the official npm registry. This setup enables an attacker to serve arbitrary tarballs during 'npm install', which npm will unpack and run lifecycle scripts from without integrity verification or version pinning. The shipped code itself is benign, but the installation-time resolution to attacker-controlled content at pack.nppacks.com creates a supply chain risk allowing arbitrary code execution during installation.

This vulnerability allows an attacker to execute arbitrary code during the installation of the 'css-import-order' package version 1.1.0 by serving malicious content from an untrusted HTTP source. This can compromise the build or deployment environment where the package is installed. The local module code is not harmful, but the installation process is exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix or official guidance is available, avoid installing 'css-import-order' version 1.1.0 from untrusted sources. Prefer packages sourced exclusively from the official npm registry and verify package integrity. Consider auditing dependencies for similar supply chain risks.