Malicious code in integration-amplitude (npm)

The 'integration-amplitude' npm package version 45.0.0 includes a dependency declaration referencing its own name but sourced from an external URL (https://repo.securityctrl.com/integration-amplitude) rather than a standard registry version. During 'npm install', this causes npm to fetch and execute code from the external host without version pinning or integrity checks, enabling arbitrary code execution. The shipped index.js is minimal, indicating the main attack vector is the dependency confusion mechanism. Control of the external host equates to control over the installer's machine. This is a malicious package designed to compromise systems that install it.

Systems installing 'integration-amplitude' version 45.0.0 are fully compromised, as arbitrary code from an attacker-controlled host executes during installation. All secrets and keys on affected systems are at risk and should be rotated immediately. Removing the package alone may not remove all malicious artifacts or backdoors installed by the attacker.

No official patch or fix is available. The package should be removed immediately from any affected systems. All secrets and keys stored on compromised machines must be rotated from a separate, trusted environment. Due to the full compromise risk, affected systems should be thoroughly audited and potentially rebuilt. Avoid installing packages that declare dependencies via bare URLs without integrity checks.