Malicious code in oit-lib-oracle-util (npm)

The 'oit-lib-oracle-util' npm package at version 45.0.0 uses a dependency confusion attack vector by declaring a dependency with a bare HTTPS URL to 'https://repo.securityctrl.com/oit-lib-oracle-util', an untrusted source unrelated to the official npm registry. This causes npm to fetch and install arbitrary code from this external URL during installation, including running any lifecycle scripts, which can lead to full system compromise. The package's own index.js is an inert stub, indicating the malicious payload is delivered through the manifest and installation process rather than the package code itself. The high version number and self-referential naming are consistent with attempts to override internal packages. Systems with this package installed should be treated as compromised.

Systems with 'oit-lib-oracle-util' version 45.0.0 installed are considered fully compromised. Attackers may have gained full control, potentially accessing all secrets and keys stored on the system. The compromise is severe enough that simply removing the package does not guarantee elimination of all malicious software or backdoors introduced by the attacker.

Immediate removal of the 'oit-lib-oracle-util' package version 45.0.0 is recommended. All secrets, keys, and credentials stored on the affected system should be rotated from a separate, trusted environment. Due to the high likelihood of full system compromise, a full incident response investigation and system rebuild may be necessary. No official patch or fix is available; remediation relies on removal and credential rotation.