Malicious code in intuit-authz (npm)

The 'intuit-authz' npm package version 55.0.0 declares a dependency on itself via a direct HTTPS URL (https://repo.securityctrl.com/intuit-authz) rather than a standard npm registry semver range. This URL is unrelated to Intuit's official domains, allowing the operator of repo.securityctrl.com to deliver arbitrary code executed during npm install lifecycle scripts. This setup matches a dependency confusion attack pattern targeting an internal Intuit authorization package, enabling full compromise of any system installing this package.

Any system with this package installed or running should be considered fully compromised. The attacker controlling the external URL can execute arbitrary code with the privileges of the installer. All secrets and keys stored on the compromised system are at risk and must be rotated immediately from a different, secure machine. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors.

Remove the 'intuit-authz' package version 55.0.0 immediately. Rotate all secrets and keys stored on the compromised system from a separate, secure environment. Because the package grants full control to an external entity, assume persistent compromise and perform a thorough incident response and system rebuild if necessary. No official patch or fix is available; remediation relies on removal and secret rotation.