The npm package @jm-telefonica/multibrand-components version 99.9.1 contains malicious code delivered via a dependency on an unpinned tarball URL. Installing this package executes arbitrary code controlled by an attacker, potentially compromising the entire system. The package's index.js is a stub, with the malicious payload residing in the dependency URL. This is a dependency confusion attack targeting Telefónica's internal namespace. Systems with this package installed should be considered fully compromised, and secrets must be rotated immediately.