The 'ap3-components-ui' npm package at version 9.999.0 includes a preinstall script that collects installer-side identifiers such as hostname, current working directory, username, and public IP address by querying ifconfig.me. This data is hex-encoded and exfiltrated as DNS subdomain queries to a malicious Interactsh collector domain controlled by an attacker. The package contains no legitimate library code and is structured as a dependency-confusion attack to supersede internal package versions. The presence of this package indicates a high risk of full system compromise.

Any system with this package installed or running should be considered fully compromised. The attacker may have obtained sensitive environment information and potentially full control of the system. All secrets and keys stored on the compromised system should be rotated immediately from a separate, trusted machine. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors.

Remove the 'ap3-components-ui' package version 9.999.0 immediately. Rotate all secrets and keys that were stored or used on the compromised system from a different, secure computer. Because full system compromise is possible, conduct a thorough investigation and remediation of the affected host. No official patch or fix is available; the package itself is malicious and should be avoided.