Malicious code in nx-app (npm)

The 'nx-app' npm package version 9999.0.0-security-test declares a dependency on itself using a raw HTTPS URL (https://repo.securityctrl.com/nx-app) instead of a standard semver range pointing to the npm registry. This causes npm to download and execute lifecycle scripts from the specified external URL without version pinning, integrity verification, or signature checks. This dependency-confusion technique ensures that the off-registry URL is used even if a registry-hosted 'nx-app' exists. The shipped source code is an inert stub, so the malicious payload is delivered solely via the external URL. Installing this package results in full compromise of the host system.

Installing this package grants the attacker full control over the compromised machine. All secrets and keys stored on the system are at risk and should be considered compromised. Removal of the package does not guarantee elimination of all malicious software installed as a result of the compromise.

Immediate removal of the 'nx-app' package version 9999.0.0-security-test is recommended. All secrets and keys stored on the compromised machine must be rotated from a separate, secure system. Due to the high likelihood of full system compromise, a complete system rebuild or forensic analysis is advised to ensure all malicious artifacts are eradicated. There is no official patch or fix available; remediation relies on removal and secret rotation.