Malicious code in @platform-services/hrm-mfe-core (npm)

The '@platform-services/hrm-mfe-core' npm package version 99.9.1 contains a self-referential dependency pointing to a tarball hosted on an unrelated external domain (https://s3.amazonaws.com/static.puffnetwork.com/check-network-2.2.1.tgz). When installed, npm fetches and executes code from this external source without integrity checks, enabling execution of potentially malicious lifecycle scripts. The package's index.js is inert, making the dependency declaration the primary attack surface. This dependency-confusion style setup allows an attacker controlling the external S3 object to execute arbitrary code on the installer's system. Additionally, the package communicates with a domain associated with malicious activity, reinforcing its classification as malicious.

Installation of this package version can lead to execution of arbitrary code from an attacker-controlled external source during npm install. This can compromise the security of the system performing the installation. The communication with a malicious domain may also result in data exfiltration or further compromise.

No official patch or remediation is indicated in the provided data. Users should avoid installing '@platform-services/hrm-mfe-core' version 99.9.1 and audit their dependencies for this package. Verify package sources and avoid dependencies that reference external URLs without integrity checks. Monitor for updates from the package maintainers or npm advisories for any official fixes.