Malicious code in search-reservation (npm)

The 'search-reservation' npm package version 55.0.0 declares a dependency with the same name as the package, pointing to an external URL (https://repo.securityctrl.com/search-reservation) instead of a version range. During installation, npm downloads and executes code from this URL without verifying integrity or pinning the version, allowing whoever controls the remote server to execute arbitrary code on the installer's machine. The package's own index.js is inert, indicating the malicious payload is delivered solely via this dependency URL. This technique resembles dependency confusion attacks targeting internal packages named 'search-reservation'.

Systems that have installed or run this package version are considered fully compromised. Attackers controlling the remote URL can execute arbitrary code during installation, potentially gaining full control over the affected machine. All secrets and keys stored on the compromised system should be rotated immediately from a secure, unaffected environment. Removing the package alone may not fully eradicate the compromise due to possible persistence mechanisms installed by the attacker.

No official patch or remediation is currently documented. Immediate removal of the 'search-reservation' package version 55.0.0 is recommended. All secrets and keys on affected systems should be rotated from a different, secure machine. Due to the high likelihood of full system compromise, a thorough incident response including system reimaging or forensic analysis is advised. Monitor for any unexpected network or system activity related to this package. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.