Malicious code in ring-device-settings-library (npm)

The ring-device-settings-library npm package declares a dependency with the same name as itself, but the dependency value is a raw HTTPS URL to https://repo.securityctrl.com/ring-device-settings-library, an off-registry host unrelated to the npm registry. When npm install runs, it resolves this URL and installs whatever code is served, including any lifecycle scripts, without version pinning, integrity checks, or signature verification. The package contents are otherwise inert, so the malicious code execution vector is entirely through this self-referential dependency. This design also exploits dependency confusion by using a high version number (45.0.0) that can override internal package versions. Any system with this package installed or running should be considered fully compromised.

Systems that install or run this package are at risk of full compromise because the off-registry dependency allows arbitrary code execution during installation. Attackers controlling the external host can execute any code on the victim machine, potentially stealing secrets, keys, and other sensitive data. Removal of the package does not guarantee elimination of all malicious artifacts, as the attacker may have established persistent control.

Remove the ring-device-settings-library package immediately from all affected systems. Rotate all secrets and keys stored on compromised machines from a separate, trusted environment. Since the package fetches code from an untrusted external source without verification, avoid installing packages that declare dependencies via raw URLs from unknown hosts. Monitor for any signs of persistent compromise and rebuild affected systems if necessary. Patch status is not confirmed; check vendor advisories for updates.