mintel-taskbar

Details

**Severity:** Critical

**Affected versions:** `= 45.0.0`

## Source: amazon-inspector (5ebda78171ac8816c0e350f84923af0bad54c075f91cfcc1a7bcc26d36674c4f)
package.json line 11 declares the package's own name 'mintel-taskbar' as a dependency whose source is the bare HTTPS URL https://repo.securityctrl.com/mintel-taskbar, not a registry version range. On `npm install`, npm resolves this dependency by fetching whatever tarball that URL returns and installs it — running any lifecycle scripts inside the fetched tarball — with no version pin and no integrity check. Whoever controls repo.securityctrl.com therefore controls code executed on every installer's machine. The self-referential shape (dependency key equals the package's own name) combined with an implausibly high version (45.0.0) is consistent with a dependency-confusion lure that resolves against an internal package of the same name.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/8278ab2bd67eee704962fa11801bbf9da85d4939/osv/malicious/npm/mintel-taskbar/MAL-2026-15514.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/8278ab2bd67eee704962fa11801bbf9da85d4939/osv/malicious/npm/mintel-taskbar/MAL-2026-15514.json
- https://www.npmjs.com/package/mintel-taskbar/v/45.0.0
- https://github.com/advisories/GHSA-9wq2-9hhc-j47x

Compromised versions (1)

• = 45.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.