The npm package lusha-iam-widgets version 1.5.2 contains malicious code due to a dependency on a node-fetch package fetched from an attacker-controlled tarball URL unrelated to the official npm registry or Lusha infrastructure. This malicious dependency executes code during installation and at runtime, impersonating Lusha's B2B IAM tooling to lure internal build systems and organizations that install lusha-* packages.