Malicious code in tabbables (npm)

The 'tabbables' npm package version 45.0.0 declares a dependency on itself using a raw HTTPS URL (https://repo.securityctrl.com/tabbables) instead of a version range from the npm registry. This causes npm to fetch and install a tarball from an untrusted external source during installation, executing any lifecycle scripts it contains without integrity verification or provenance. The shipped index.js is inert, so the malicious payload is delivered solely via the external tarball, which can be changed at any time by the controller of repo.securityctrl.com. This creates a dependency confusion scenario with an implausibly high version number competing with internal packages of the same name. The package is considered fully malicious, and any system running it is likely compromised.

Systems that have installed or are running the 'tabbables' package version 45.0.0 are considered fully compromised. The malicious package can execute arbitrary code during installation, potentially allowing attackers full control over the affected system. All secrets and keys stored on the compromised system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software or backdoors introduced by the package.

Remove the 'tabbables' package version 45.0.0 immediately from all affected systems. Rotate all secrets, keys, and credentials that were stored or used on compromised machines from a separate, secure environment. Because the package executes arbitrary code during installation and may have fully compromised the system, consider rebuilding or thoroughly auditing affected systems. There is no official patch or fix available; the package itself is malicious. Avoid installing packages that declare dependencies via raw URLs without integrity checks.