The npm package @factoryz/apollo version 99.9.1 is a malicious package that acts as a lure. It contains only an empty stub but declares a dependency on an off-registry tarball fetched via a hardcoded HTTPS URL without integrity checks or version pinning. Installing this package causes arbitrary code execution from the fetched tarball, potentially compromising the host system. Any system with this package installed should be considered fully compromised, and all secrets and keys on that system should be rotated immediately. Removal of the package alone does not guarantee elimination of all malicious software.