The npm package 'xo-ui-components' version 88.8.9 contains malicious code that installs a dependency from a custom domain which executes an information stealer during installation. This malware targets sensitive tokens related to npm, git, and CI/CD environments. Systems with this package installed should be considered fully compromised, and all secrets and keys stored on those systems must be rotated immediately. Removal of the package alone may not eliminate all malicious software introduced.