Malicious code in librastandardlib (npm)

The 'librastandardlib' npm package version 45.0.0 declares a dependency with the same name as the package, but instead of a version range, it uses an off-registry HTTPS URL (https://repo.securityctrl.com/librastandardlib). When npm installs this package, it fetches code from this external URL and executes lifecycle scripts without version pinning or integrity checks. This dependency-confusion technique allows an attacker controlling the external repository to run arbitrary code on the installer's machine. The package's index.js is a benign stub, making the manifest URL the actual attack vector. This results in full compromise of any system installing this package version.

Any computer with 'librastandardlib' version 45.0.0 installed or running is considered fully compromised. The attacker gains arbitrary code execution during installation, potentially leading to theft of secrets, keys, and full system control. Because the malicious payload is delivered via an external URL and executed without integrity verification, the attacker can modify the payload at will. Simply removing the package does not guarantee removal of all malicious software introduced, necessitating secret/key rotation from a trusted environment.

No official patch or fix is currently documented. The best mitigation is to immediately remove the 'librastandardlib' package version 45.0.0 from all systems. Rotate all secrets and keys that may have been exposed, performing this from a secure, uncompromised machine. Avoid installing packages that declare dependencies via off-registry URLs without integrity checks. Monitor for any suspicious activity resulting from this compromise. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.