mintel-taskbar

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (5ebda78171ac8816c0e350f84923af0bad54c075f91cfcc1a7bcc26d36674c4f)
package.json line 11 declares the package's own name 'mintel-taskbar' as a dependency whose source is the bare HTTPS URL https://repo.securityctrl.com/mintel-taskbar, not a registry version range. On `npm install`, npm resolves this dependency by fetching whatever tarball that URL returns and installs it — running any lifecycle scripts inside the fetched tarball — with no version pin and no integrity check. Whoever controls repo.securityctrl.com therefore controls code executed on every installer's machine. The self-referential shape (dependency key equals the package's own name) combined with an implausibly high version (45.0.0) is consistent with a dependency-confusion lure that resolves against an internal package of the same name.

Compromised versions (1)

• 45.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.