Malicious code in payments-ui-services (npm)

The 'payments-ui-services' npm package version 45.0.0 declares a dependency sourced from an arbitrary HTTPS URL (https://repo.securityctrl.com/payments-ui-services) instead of a standard registry version range. This causes 'npm install' to fetch and execute code from an untrusted external host without version pinning or integrity checks, enabling the remote operator to execute arbitrary code on the installer's machine. The package's own dependency key matches its name, a known pattern for dependency confusion attacks. The package's version is unusually high for a minimal placeholder package, and the hosting domain is unrelated to the declared publisher, confirming malicious intent. Any system with this package installed is considered fully compromised.

Installation of this package version results in remote code execution controlled by the operator of the external host, leading to full system compromise. All secrets and keys stored on the compromised machine are at risk and must be rotated from a secure environment. Removing the package does not guarantee removal of all malicious artifacts due to potential persistent backdoors or additional malware installed during execution.

Remove the 'payments-ui-services' package version 45.0.0 immediately from all affected systems. Rotate all secrets and keys that were stored or accessible on compromised machines from a trusted, uncompromised environment. Since the package executes arbitrary code from an untrusted source, consider rebuilding affected systems to ensure complete removal of any persistent malicious software. Monitor for any unusual activity related to this package and avoid installing packages that declare dependencies from arbitrary URLs without integrity verification.