Malicious code in vui-gateway (npm)

The 'vui-gateway' npm package version 45.0.0 declares a dependency with the same name as itself, but the dependency source is an off-registry HTTPS URL (https://repo.securityctrl.com/vui-gateway). During 'npm install', npm fetches and executes code from this unauthenticated, mutable external source without integrity verification, enabling arbitrary code execution on the installer's machine. The shipped index.js is inert, making the manifest the main attack vector. This pattern is characteristic of dependency confusion attacks aimed at shadowing internal packages. The package installation results in full system compromise, requiring immediate secret and key rotation from a clean environment.

Installing 'vui-gateway' version 45.0.0 results in arbitrary code execution on the installer's machine due to an unauthenticated external dependency source. This leads to full compromise of the affected computer, including potential theft or misuse of stored secrets and keys. Even after removal of the package, persistent malicious software may remain, posing ongoing risk.

Remove the 'vui-gateway' package version 45.0.0 immediately. Rotate all secrets and keys stored on the affected machine from a different, trusted computer. Because the system may be fully compromised, consider rebuilding the environment to ensure complete removal of malicious software. Patch status is not yet confirmed — check the vendor advisory or trusted sources for any updates or official fixes.