The npm package 'js-component-explorer' versions 99.9.16 and 99.9.17 contain malicious code. This package communicates with a domain linked to malicious activity and executes commands associated with malicious behavior. It has been identified as malicious by the OpenSSF Package Analysis project and Amazon Inspector. No CVSS score or known exploits in the wild have been reported.