The kraken-ui npm package version 999.0.0 contains malicious code that exfiltrates sensitive host and user information to an attacker-controlled server upon loading. This package is a dependency confusion attack proof of concept, published publicly to override an internal package of the same name. Installing or running this package can lead to full system compromise, requiring immediate secret and key rotation and package removal.