The npm package @flexmr/survey-client version 10.0.12 and several other versions declare a dependency as a bare HTTPS URL pointing to an external host unrelated to the official npm registry. This external host controls the code executed during installation, allowing arbitrary code execution on the installer's machine. The package exhibits dependency confusion markers and placeholder metadata inconsistent with a legitimate package, indicating malicious intent. Any system with this package installed should be considered fully compromised.