Malicious code in paper-password-input (npm)

The 'paper-password-input' npm package version 45.0.0 declares a dependency whose key matches the package's own name and whose value is a bare HTTPS URL (https://repo.securityctrl.com/paper-password-input) rather than a version range from the npm registry. When npm installs this package, it fetches and executes any lifecycle scripts from the tarball served at that URL without version pinning or integrity checks. The shipped index.js is inert, making the manifest and dependency declaration the attack surface. This setup enables whoever controls the external URL to deliver arbitrary code to all installers, consistent with a dependency confusion attack targeting an internal package name. The package is considered fully malicious, and any system with it installed should be treated as compromised.

Systems with 'paper-password-input' version 45.0.0 installed are fully compromised. Attackers controlling the external URL can execute arbitrary code during installation, potentially gaining full control of the affected system. All secrets and keys stored on the compromised system should be rotated immediately from a secure environment. Removing the package alone may not eliminate all malicious software introduced by the compromise.

Remove the 'paper-password-input' package version 45.0.0 immediately from all affected systems. Rotate all secrets and keys stored on compromised machines from a different, secure computer. Because the package allows arbitrary code execution during installation, assume full system compromise and perform a thorough incident response. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for any updates or official fixes.