The ms-client-portal npm package is a malicious dependency-confusion package containing no functional code but executing scripts that send sensitive environment information to an external server during installation. It was published with versions 1.0.0 and 10.0.0 on 2026-10-31. Installation of this package results in exposure of user name, hostname, and working directory to a remote attacker. Systems with this package installed should be considered fully compromised, and all secrets and keys must be rotated immediately from a different machine.