Malicious code in @sourceflow-uk/sourceflow-tracker (npm)

The npm package @sourceflow-uk/sourceflow-tracker at version 99.91.9 declares a dependency 'ltidisafe' that points to a tarball hosted on an unrelated Google Cloud Storage bucket. This tarball is not version-pinned or hash-verified, enabling the bucket owner to swap its contents at any time. The package itself contains minimal code inconsistent with its advertised functionality, indicating it is a throwaway lure to chain-load the external tarball. Installing this package results in execution of lifecycle scripts from the external tarball, which can fully compromise the installing machine. The vendor or publisher does not control the external dependency, making the package a vector for arbitrary malicious code execution.

Systems that have installed @sourceflow-uk/sourceflow-tracker version 99.91.9 are considered fully compromised due to execution of arbitrary code from an uncontrolled external tarball. Attackers may gain full control over the affected system, potentially accessing all stored secrets and keys. Removal of the package alone does not guarantee elimination of all malicious software introduced. Immediate secret and key rotation from a separate, uncompromised machine is required to mitigate impact.

Remove the @sourceflow-uk/sourceflow-tracker package version 99.91.9 immediately from all affected systems. Rotate all secrets and keys stored on compromised machines from a different, secure computer. Since the package executes arbitrary code from an external source not controlled by the publisher, avoid installing this package or any dependencies that fetch code from untrusted URLs. Monitor for any signs of persistent compromise and consider full system reimaging if compromise is suspected. Patch status is not applicable as this is a malicious package rather than a vulnerability with an official fix.