The lusha-iam-widgets npm package version 1.5.2 declares a dependency on node-fetch via a tarball URL hosted on registry.ctzbg.com, a domain unrelated to npm or Lusha. When npm installs this package, it fetches and installs the attacker-controlled node-fetch package, which runs lifecycle scripts on the installer's machine. Additionally, the main component imports this malicious node-fetch, causing execution of attacker code at require time. The package name and stated purpose mimic Lusha's internal tooling, indicating a dependency confusion attack targeting Lusha's build systems and any organization installing lusha-* packages.

Installation of lusha-iam-widgets version 1.5.2 results in execution of attacker-controlled code during package installation and runtime, potentially compromising the build environment or systems using this package. The malicious dependency can execute arbitrary code, leading to possible system compromise or data exposure. There are no known exploits in the wild reported at this time.

No official patch or fix is currently available. Users should avoid installing lusha-iam-widgets version 1.5.2 and any lusha-* packages from untrusted sources. Verify package authenticity and dependencies before installation. Monitor for updates from the vendor or npm registry regarding remediation. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.