The npm package @mntv-analysis/ui-components version 50.1.1 is a malicious package published by the user 'conx3993' as part of a dependency confusion attack. It masquerades as an internal package and executes a preinstall script that sends an HTTPS request to an attacker-controlled server, leaking the victim's public IP address and signaling successful installation. The package contains no legitimate UI component code and serves solely as a tracking beacon.