MAL-2026-17870 — Malicious code in @mntv-analysis/ui-components (npm)

npm user “conx3993” published this package in a dependency confusion campaign. The package squats a name resembling an internal package, and version 50.1.1 may be selected over the real package by misconfigured resolvers. Code executed during installation sends data to the attacker-controlled host realwbx.com.