Malicious code in loading-performance-instrumentation (npm)

The 'loading-performance-instrumentation' npm package version 45.0.0 includes a dependency declaration that points to a bare URL (https://repo.securityctrl.com/loading-performance-instrumentation) rather than a versioned package from the npm registry. This dependency-confusion pattern enables npm to fetch and execute arbitrary code from the specified URL during installation, as lifecycle scripts in the fetched tarball run automatically. The package's README misleadingly suggests it is a placeholder to prevent dependency confusion, but the manifest contradicts this by resolving the dependency to a third-party host. The installed code is a stub, but the install-time payload is delivered via the URL, which can change at any time. According to the GHSA malware source, any system with this package installed should be considered fully compromised, requiring immediate secret and key rotation from a separate machine and package removal, though removal may not guarantee full remediation.

Systems with 'loading-performance-instrumentation' version 45.0.0 installed are considered fully compromised. The malicious package can execute arbitrary code during installation, potentially giving attackers full control over the affected system. All secrets and keys stored on the compromised system should be rotated immediately from a different, secure machine. Removing the package is necessary but may not fully remove all malicious artifacts or backdoors introduced by the package.

Remove the 'loading-performance-instrumentation' package version 45.0.0 immediately from all affected systems. Rotate all secrets and keys that were stored on the compromised machines using a secure, unaffected environment. Because the package executes arbitrary code during installation, assume full system compromise and conduct a thorough investigation and remediation. Patch status is not applicable as this is a malicious package rather than a vulnerability with a vendor fix.