Malicious code in one-intuit-help-system-utils (npm)

The 'one-intuit-help-system-utils' npm package version 45.0.0 declares a dependency with the same name as the package, but instead of a version range, it uses a bare HTTPS URL (https://repo.securityctrl.com/one-intuit-help-system-utils). When npm installs this package, it fetches and executes code from this URL without version pinning, integrity checks, or publisher verification. This design allows the attacker to deliver arbitrary and changeable malicious code at install time, effectively compromising any system that installs this package. The package's high version number and self-referential dependency suggest an attempt to override internal packages via dependency confusion.

Any system with this package installed is considered fully compromised. Attackers may have executed arbitrary code with full control over the affected system. All stored secrets and keys on the compromised system are at risk and should be rotated immediately from a secure environment. Removing the package alone may not remove all malicious artifacts or backdoors introduced by the attacker.

Remove the 'one-intuit-help-system-utils' package version 45.0.0 immediately from all affected systems. Rotate all secrets, keys, and credentials that were stored or used on compromised systems from a different, trusted environment. Because the package executes arbitrary code at install time and may have established persistence, consider rebuilding affected systems or performing thorough forensic analysis to ensure complete remediation. Monitor for any further use of dependency confusion or malicious package installations in your supply chain.