Malicious code in sycm-vendors (npm)

The 'sycm-vendors' npm package version 55.0.0 declares a dependency on itself using a bare URL (https://repo.securityctrl.com/sycm-vendors) instead of a versioned registry reference, without version pinning or integrity verification. When npm installs this package, it fetches and executes lifecycle scripts from the tarball served by the external URL, enabling arbitrary code execution if the repository is malicious. The package's shipped code is inert, indicating the attack vector is the dependency declaration and the external tarball. Control over the external repository equates to full compromise of any system installing this package.

Systems that install 'sycm-vendors' version 55.0.0 are at risk of arbitrary code execution by an attacker controlling the external repository. This can lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Removal of the package alone does not guarantee eradication of all malicious artifacts, as the attacker may have established persistent control.

Immediate removal of the 'sycm-vendors' package version 55.0.0 is recommended. All secrets and keys on affected systems should be rotated from a separate, uncompromised environment. Due to the potential for full system compromise, a thorough incident response and system rebuild may be necessary. No official patch or fix is indicated; avoidance of this package version is advised.