Malicious code in npm-extension (npm)

The npm-extension package version 45.0.0 declares a dependency using a bare HTTPS URL (https://repo.securityctrl.com/npm-extension) instead of a version range from the npm registry. This forces npm to fetch a tarball from an off-registry host and execute any lifecycle scripts contained therein without integrity verification. The package's own index.js is inert, meaning the malicious payload is entirely delivered through the fetched third-party code. This dependency-confusion style attack results in arbitrary code execution on machines installing the package, potentially leading to full system compromise.

Any system that installs or runs the npm-extension package version 45.0.0 is at risk of full compromise. Attackers may gain complete control over the affected machine, potentially accessing all stored secrets and keys. Because the malicious code executes during installation with no integrity checks, the system's security is severely undermined. Simply removing the package does not guarantee removal of all malicious artifacts or backdoors introduced by the attacker.

Immediate removal of the npm-extension package version 45.0.0 is recommended. All secrets and keys on affected systems should be rotated from a separate, trusted machine. Due to the high risk of full compromise, a full system forensic analysis and potential rebuild may be necessary. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates or official fixes. Avoid installing packages that declare dependencies via bare HTTPS URLs from untrusted sources.