Malicious code in qbo-ui-services (npm)

The 'qbo-ui-services' npm package version 45.0.0 declares a self-referential dependency using a bare HTTP URL (https://repo.securityctrl.com/qbo-ui-services) instead of a standard registry version range. This causes npm to fetch and execute arbitrary code from an untrusted external source during installation without version pinning or integrity verification. The package's own index.js is inert, indicating the malicious payload is in the dependency resolution mechanism designed to override internal packages. The external host is unrelated to the official package repository, indicating a dependency confusion attack vector. Installation of this package results in full system compromise.

Any system with 'qbo-ui-services' version 45.0.0 installed or running is considered fully compromised. Attackers may gain full control, potentially accessing all stored secrets and keys. Removal of the package alone does not guarantee eradication of malicious software introduced. Immediate secret rotation from a clean system is required to mitigate credential exposure.

Remove the 'qbo-ui-services' package version 45.0.0 immediately from all affected systems. Rotate all secrets and keys stored on compromised machines from a separate, trusted environment. Due to the high risk of full system compromise, consider rebuilding affected systems to ensure complete removal of malicious artifacts. Monitor for any unexpected network or system activity related to this package. Patch status is not confirmed; check vendor or registry advisories for updates or official fixes.