Malicious code in sentrykit (npm)

The 'sentrykit' npm package version 30.0.0 declares a self-referential dependency with the key 'sentrykit' mapped to an HTTPS URL outside the official npm registry (https://repo.securityctrl.com/sentrykit). When 'npm install' is run, the package manager fetches and installs a tarball from this URL without integrity checks, executing any lifecycle scripts contained therein. The version constraint is set to an implausibly high number (30.0.0) to win dependency resolution over any internal package of the same name, a known dependency confusion technique. Control over the external URL allows an attacker to execute arbitrary code on the installer's machine at install time. The package body itself is minimal, serving primarily as a delivery mechanism for malicious code.

Any system with 'sentrykit' version 30.0.0 installed or running is considered fully compromised. Attackers may have gained full control over the host, including access to secrets and keys stored on the machine. Immediate rotation of all secrets and keys from a different, trusted system is required. Simply removing the package does not guarantee removal of all malicious artifacts or backdoors introduced during installation.

No official patch or fix is available. The package 'sentrykit' version 30.0.0 should be removed immediately. All secrets and keys stored on affected systems must be rotated from a secure, uncompromised environment. Due to the high risk of full system compromise, affected systems should be thoroughly investigated and potentially rebuilt to ensure complete remediation.