The unified-ui-components-library npm package (versions 10.0.1, 10.0.2, and 10.0.3) includes a postinstall script that collects system identifiers (hostname and username) and sends them in plaintext via an HTTP GET request to a hardcoded IP address. This request masquerades as an image download but serves as a beacon to the attacker, logging identifying information of each installation. Additionally, the package follows HTTP redirects to attacker-controlled locations and writes the response body to a local file without validating content type, enabling staging of malicious payloads. The package's metadata and README misrepresent its functionality, consistent with malicious intent. The presence of this package indicates a full system compromise.

Installation of the affected package versions results in disclosure of machine hostname and user information to an attacker-controlled server. The attacker can log each installation uniquely and stage additional malicious payloads on the compromised system by downloading arbitrary files without validation. This compromises the confidentiality and integrity of the affected system. The advisory states that any computer with this package installed should be considered fully compromised, and all secrets and keys on the system should be rotated immediately from a different machine.

Remove the affected package versions (10.0.1, 10.0.2, 10.0.3) immediately from all systems. Rotate all secrets, credentials, and keys that were stored or used on the compromised machines from a secure, unaffected environment. Because the package grants potential full control to an attacker, assume the system is fully compromised and consider rebuilding or thoroughly investigating for persistence mechanisms. Patch status is not applicable as this is a malicious package rather than a vulnerability with a vendor fix. No official fix or patch is available; mitigation relies on removal and secret rotation.