The ui-ng-components package at version 99.9.1 is an empty shell with no author or functionality, crafted to perform a dependency confusion attack by referencing an external tarball URL as a dependency. When installed via npm, the external tarball is fetched and its lifecycle scripts execute on the victim's machine, potentially allowing full system compromise. The package itself contains no library code; its sole purpose is to deliver and execute malicious code from the remote tarball. This attack vector exploits the npm install process and the trust in package dependencies, making any system with this package installed fully compromised.

Systems that have installed [email protected] are considered fully compromised. Attackers may have gained full control over the affected machine, potentially accessing all stored secrets and keys. The compromise may persist beyond removal of the package due to installed malware or backdoors. Immediate secret/key rotation is required from a secure environment to prevent further unauthorized access.

No official patch or fix is available for this malicious package. The recommended mitigation is to remove [email protected] immediately from all affected systems. All secrets and keys stored on compromised machines must be rotated from a different, secure computer. Due to the high likelihood of full system compromise, a thorough incident response and system rebuild may be necessary. Monitor for any signs of persistent malicious activity beyond package removal.