Malicious code in mkt-ui-library (npm)

The 'mkt-ui-library' npm package version 45.0.0 declares a dependency with the same name as the package itself, but instead of a version range, it uses a bare HTTPS URL (https://repo.securityctrl.com/mkt-ui-library). When npm installs this package, it fetches the tarball from this URL and executes any lifecycle scripts contained within, without version pinning or integrity checks. This dependency confusion technique biases npm resolvers to prefer the malicious external package over any legitimate internal versions. Although the shipped source code is a benign stub, whoever controls the external repository controls the code executed on the installer's machine, leading to full system compromise.

Any system that installs or runs this package version is at risk of full compromise. An attacker controlling the external repository can execute arbitrary code during installation, potentially gaining full control over the affected machine. All secrets and keys stored on the compromised system should be considered exposed and must be rotated from a separate, secure environment. Removing the package alone may not eliminate all malicious artifacts due to the potential for persistent compromise.

No official patch or fix is currently available. Immediate removal of the 'mkt-ui-library' package version 45.0.0 is recommended. Systems with this package installed should be treated as fully compromised, and all secrets and keys must be rotated from a different, secure machine. Monitor for any suspicious activity and consider rebuilding affected systems to ensure complete remediation. Verify dependencies carefully to avoid installing packages with self-referencing dependencies pointing to untrusted URLs.