The npm package 'xo-page-components' versions 99.2.9 and 88.8.9 are identified as malicious. This package installs a dependency from a custom domain that executes an information stealer during installation, targeting npm, git, and CI/CD tokens. Systems with this package installed should be considered fully compromised, and all secrets and keys stored on those systems must be rotated immediately. Removing the package alone may not eliminate all malicious software resulting from its installation.