Malicious code in jira-projects-backbone (npm)

The 'jira-projects-backbone' npm package version 45.0.0 declares a dependency with the same package name pointing to a bare HTTPS URL (https://repo.securityctrl.com/jira-projects-backbone) instead of a versioned registry entry. During 'npm install', this causes npm to fetch and execute code from the attacker-controlled URL without integrity verification. The shipped package is a stub, making the manifest the entire attack surface. This setup enables dependency confusion and results in installation of attacker-controlled code, fully compromising the host system.

Any system that installs or runs this package version is considered fully compromised. Attackers may gain complete control, potentially accessing all secrets and keys stored on the system. Because the malicious code executes during installation, it can establish persistent backdoors or other malware. Removing the package alone does not guarantee removal of all malicious artifacts or control established by the attacker.

Remove the 'jira-projects-backbone' package version 45.0.0 immediately from all affected systems. Rotate all secrets and keys from a trusted, uncompromised environment. Because the system may be fully compromised, consider rebuilding affected hosts from known-good backups or reinstalling the operating system. Monitor for any signs of persistent compromise. Patch status is not confirmed; check vendor advisories for updates or official guidance.