The npm package ui-ng-components version 99.9.1 is a malicious package designed for dependency confusion attacks. It contains no legitimate code but declares a dependency on a remote tarball hosted outside the npm registry. Installing this package triggers execution of potentially harmful lifecycle scripts from the external tarball, compromising the installer's machine. Any system with this package installed should be considered fully compromised, and all secrets and keys on that system must be rotated immediately. Removal of the package alone does not guarantee full remediation due to possible persistent malicious activity.