Threats Tagged 'mal-2026-15514'

The npm package 'mintel-taskbar' version 45.0.0 contains malicious code that executes arbitrary code from an external source during installation. It declares a self-referential dependency pointing to a remote URL without version pinning or integrity checks, enabling an attacker controlling that URL to execute code on any machine installing the package. This behavior is consistent with a dependency confusion attack. Systems with this package installed should be considered fully compromised, and all secrets and keys on those systems must be rotated. Removal of the package alone may not eliminate all malicious components.