Malicious code in prm-bundles (npm)

The 'prm-bundles' npm package version 45.0.0 declares a dependency on itself using a bare HTTPS URL (https://repo.securityctrl.com/prm-bundles) instead of a version range. This causes npm install to download and execute code from that URL, bypassing version pinning and integrity verification. The shipped source code is inert, making the manifest the payload delivery mechanism. This behavior is consistent with a dependency confusion attack targeting an internal package name, allowing an attacker to execute arbitrary code on the installing system. The package is considered fully compromising any system where it is installed or running.

Systems with 'prm-bundles' version 45.0.0 installed are fully compromised, potentially allowing attackers complete control. All secrets and keys on affected systems should be considered exposed and must be rotated from a separate, uncompromised device. Removing the package alone may not remove all malicious artifacts or restore system integrity.

Immediate removal of the 'prm-bundles' package version 45.0.0 is recommended. All secrets and keys stored on affected systems should be rotated from a different, trusted computer. Due to the high likelihood of full system compromise, consider rebuilding or thoroughly cleaning affected systems. There is no official patch or fix available; remediation relies on removal and secret rotation.