Malicious code in firestore-lite (npm)

This threat involves a malicious npm package named 'firestore-lite' at version 45.0.0. The package.json declares a dependency on itself via a bare HTTP URL rather than a version range from a trusted registry, enabling npm to fetch and execute arbitrary code from an untrusted source. The package's index.js is an inert stub, indicating the payload is delivered through the manifest and lifecycle scripts. This is a dependency confusion attack aiming to hijack package resolution and execute malicious code. Any system with this package installed is considered fully compromised, with all stored secrets and keys at risk.

Systems with this package installed are fully compromised. The attacker may gain full control over the affected computer, potentially accessing all secrets and keys stored on it. Removing the package does not guarantee removal of all malicious software or backdoors introduced by the package installation.

Remove the malicious 'firestore-lite' package version 45.0.0 immediately. Rotate all secrets and keys from a separate, trusted system. Because full system compromise is possible, consider a full system audit and reinstallation to ensure removal of all malicious artifacts. Avoid installing packages from untrusted sources or with dependencies declared via bare HTTP URLs without integrity checks.