Malicious code in data-value (npm)

The 'data-value' npm package version 45.0.0 declares a dependency on itself using an arbitrary HTTPS URL (https://repo.securityctrl.com/data-value) rather than a standard registry version. During 'npm install', npm fetches the package from this URL and executes lifecycle scripts contained in the fetched tarball without verifying version or integrity. This dependency-confusion technique allows an attacker controlling the external URL to execute arbitrary code on the installer's machine at install time. The shipped index.js is a benign stub, so the malicious payload is delivered solely via the dependency declaration. This results in full compromise of any system installing this package version.

Any system that installs or runs the 'data-value' package version 45.0.0 is fully compromised due to arbitrary code execution during installation. Attackers controlling the external URL can execute any code with the installer's privileges. This compromises all secrets and keys stored on the system. Removing the package does not guarantee removal of all malicious artifacts, as attackers may have established persistent control.

Remove the 'data-value' package version 45.0.0 immediately from all systems. Rotate all secrets and keys from a separate, uncompromised machine. Avoid installing packages that declare dependencies from arbitrary URLs outside official registries. Monitor for any signs of persistent compromise and rebuild affected systems if necessary. Patch status is not confirmed; check vendor advisories for updates or official fixes.