@walletify/ui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via DNS discovery. An attacker can access internal network resources and exfiltrate data by sending crafted requests for realms that trigger DNS queries to attacker-controlled zones.

Affected versions of this package are vulnerable to Arbitrary Code Injection via the oidc-claims-extension.groovy script when the claims_parameter_supported parameter is enabled. An attacker can inject arbitrary values into claims returned in id_token or user_info by supplying a crafted JSON file in the claims parameter, potentially impersonating other users or manipulating identity data.