Malicious code in katal-logger (npm)

The katal-logger npm package version 45.0.0 includes a dependency declaration that uses a bare HTTPS URL (https://repo.securityctrl.com/katal-logger) instead of a standard npm registry version range. When npm installs this package, it fetches and executes code from this external URL without integrity verification or version pinning. The external host is unrelated to the official npm registry, so control over this host equates to arbitrary code execution on the installing machine. The package's own index.js is inert, indicating the malicious payload is delivered solely through this dependency mechanism. This design effectively creates a dependency confusion scenario, enabling remote code execution during installation.

Systems that install katal-logger version 45.0.0 are at risk of arbitrary code execution from an untrusted external source. This compromises the entire system, potentially exposing all stored secrets and keys. The compromise is severe enough that removal of the package alone does not guarantee eradication of malicious software or backdoors. Immediate secret and key rotation from a separate, uncompromised system is required to mitigate ongoing risk.

Remove the katal-logger package version 45.0.0 immediately from all affected systems. Rotate all secrets and keys stored on compromised machines using a separate, trusted system. Because the package allows arbitrary code execution from an external source, assume full system compromise and conduct thorough incident response. Patch status is not confirmed; check vendor advisories for updates. No official fix or patch is currently documented.