The npm package 'ap3-components-ui' version 9.999.0 contains malicious code that executes a preinstall hook to collect sensitive installer environment data and exfiltrates it via DNS queries to an attacker-controlled domain. The package is a dependency-confusion squat designed to override legitimate internal packages. Installation of this package can lead to full system compromise, requiring immediate secret and key rotation and package removal.