Malicious code in gridster-coords (npm)

The 'gridster-coords' npm package version 45.0.0 uses a dependency declaration that points to an untrusted HTTPS URL (https://repo.securityctrl.com/gridster-coords) instead of a versioned registry package. This allows npm to fetch and execute arbitrary lifecycle scripts from the external source during installation without integrity checks or version pinning. The package's own dependency key matches its name, a pattern indicative of dependency confusion attacks. The external repository is unrelated to npm or the legitimate package publisher. The shipped source code is inert, making the manifest the primary vector for delivering malicious code execution on the installer's machine. Systems with this package installed are considered fully compromised.

Installation of this package version results in arbitrary code execution on the installer's machine via lifecycle scripts fetched from an untrusted external URL. This can lead to full system compromise, including unauthorized access to secrets and keys stored on the affected system. Because the package grants potential full control to an attacker, removal alone may not eliminate all malicious software or backdoors introduced during installation.

Immediate removal of the 'gridster-coords' package version 45.0.0 is recommended. All secrets and keys stored on the affected system should be rotated from a different, trusted machine. Due to the high likelihood of full system compromise, a full forensic investigation and system rebuild may be necessary. No official patch or fix is available; users should avoid installing this package version and verify dependencies do not reference untrusted URLs.