Malicious code in framework-zero (npm)

The framework-zero npm package at version 45.0.0 uses a dependency declaration that points to an external HTTPS URL (https://repo.securityctrl.com/framework-zero) instead of a standard npm registry version. This URL fetches and installs code without version pinning or integrity checks, enabling arbitrary code execution during npm install lifecycle scripts. The package name and version suggest a dependency confusion attack, where the malicious package masquerades as an internal dependency. The external host is unrelated to npm registries and can serve changing malicious content, leading to full system compromise upon installation.

Any system with framework-zero version 45.0.0 installed or running is considered fully compromised. Attackers may have gained full control, potentially accessing all stored secrets and keys. Immediate rotation of all credentials is required. Removing the package alone may not remove all malicious artifacts or backdoors introduced by the attacker.

Remove the framework-zero package version 45.0.0 immediately. Rotate all secrets and keys from a secure, uncompromised system. Due to the high likelihood of full system compromise, consider rebuilding affected systems from trusted backups. Monitor for any signs of persistent malicious activity. Patch status is not yet confirmed — check vendor advisories or trusted security sources for updates.