Malicious code in mintel-taskbar (npm)

The 'mintel-taskbar' npm package version 45.0.0 declares its own name as a dependency sourced from a bare HTTPS URL (https://repo.securityctrl.com/mintel-taskbar) rather than a versioned registry entry. During 'npm install', this causes npm to fetch and execute code from that URL without version pinning or integrity verification, allowing whoever controls the URL to run arbitrary code on the installer's machine. The self-referential dependency and unusually high version number suggest a dependency confusion attack targeting internal packages. This results in full compromise of affected systems.

Any computer with 'mintel-taskbar' version 45.0.0 installed or running is considered fully compromised. Attackers controlling the external repository URL can execute arbitrary code during installation, potentially leading to complete system takeover. All secrets and keys stored on the compromised machine are at risk and must be rotated. Removing the package does not guarantee removal of all malicious artifacts.

Immediate removal of the 'mintel-taskbar' package version 45.0.0 is recommended. All secrets and keys on affected systems should be rotated from a separate, trusted machine. Due to the potential for persistent compromise, a full system reinstallation or forensic analysis may be necessary. Patch status is not confirmed; check the vendor or repository advisory for updates. Avoid installing packages that declare dependencies from untrusted URLs without integrity checks.