Malicious code in jsb-adapter (npm)

The 'jsb-adapter' npm package version 45.0.0 is malicious due to a dependency confusion attack where its package.json declares a dependency on itself with a URL to 'https://repo.securityctrl.com/jsb-adapter'. During 'npm install', npm fetches and executes code from this external URL without integrity checks, enabling arbitrary code execution controlled by whoever manages that domain. The published index.js is inert, indicating the attack relies entirely on the malicious dependency URL. This results in full compromise of any system installing this package version.

Systems that have installed 'jsb-adapter' version 45.0.0 are fully compromised. Attackers may have executed arbitrary code with the privileges of the installer, potentially stealing secrets and keys. Because the compromise occurs at install time and may include additional malware, simply removing the package does not guarantee remediation. All secrets and keys on affected systems should be rotated from a clean environment.

Remove the 'jsb-adapter' package version 45.0.0 immediately from all systems. Rotate all secrets and keys stored on affected systems from a different, uncompromised computer. Due to the nature of the compromise, assume full system control by attackers and consider rebuilding affected systems. There is no official patch or fix; the package itself is malicious. Avoid installing packages with dependencies declared as bare URLs from untrusted sources.