Malicious code in ux-metrics-client-interaction-subscriber (npm)

The npm package 'ux-metrics-client-interaction-subscriber' version 45.0.0 declares a dependency with the same name as itself, pointing to a bare HTTPS URL (https://repo.securityctrl.com/ux-metrics-client-interaction-subscriber) outside the official npm registry. During installation, npm fetches and installs code from this URL without version pinning, integrity checks, or signature verification, enabling arbitrary code execution on the installer's machine. The shipped index.js file is inert, indicating the manifest and dependency declaration are the primary delivery mechanism. Control of the external repository equates to full compromise of the installing system. This pattern resembles a dependency confusion attack aimed at overriding an internal package.

Systems that have installed or are running this package version 45.0.0 are fully compromised, as the malicious package grants arbitrary code execution to an external attacker controlling the external repository. This compromises all secrets and keys stored on the affected system, necessitating immediate rotation of credentials from a secure environment. Removal of the package alone does not guarantee eradication of all malicious artifacts or backdoors introduced during installation.

Remove the malicious package 'ux-metrics-client-interaction-subscriber' version 45.0.0 immediately from all affected systems. Rotate all secrets, keys, and credentials stored on compromised machines from a separate, secure system. Due to the potential for persistent compromise, consider full system reimaging or forensic analysis to ensure complete removal of malicious code. Monitor for any use of this package and avoid installing packages that declare dependencies from untrusted external URLs. Patch status is not applicable as this is a malicious package rather than a software vulnerability with an official fix.