Malicious code in ir-annuities-client-authentication-module (npm)

The 'ir-annuities-client-authentication-module' npm package version 30.0.0 uses a dependency confusion technique by declaring a dependency whose key matches the package name and whose value is a plain HTTPS URL to a non-registry host. This causes npm install to fetch and execute code from an external source without version pinning or integrity verification. The package's index.js is a stub, so the malicious payload is delivered through the manifest's dependency declaration and lifecycle scripts. This results in full compromise of any system installing this package.

Systems that have installed this package version are fully compromised due to execution of untrusted code fetched from an external URL during npm install. Attackers may gain full control, potentially accessing all secrets and keys stored on the system. Removing the package does not guarantee removal of all malicious software introduced by the compromise.

Remove the 'ir-annuities-client-authentication-module' package version 30.0.0 immediately. Rotate all secrets and keys from a secure, uncompromised system. Due to the full compromise risk, consider rebuilding affected systems. There is no official patch or fix available; avoid using this package version entirely.