The corporate-front-vue package at version 99.9.1 is a malicious npm package that acts as a loader for an attacker-controlled tarball hosted on Google Cloud Storage. This tarball is fetched and installed during npm install, bypassing npm registry review and allowing execution of arbitrary code on the installer's machine. The package metadata and versioning indicate a dependency confusion attack pattern, aiming to supersede legitimate internal packages. The package exports an empty object and serves only to trigger installation of the malicious payload. This results in full compromise of any affected system.

Systems that install [email protected] are fully compromised, as the package executes attacker-controlled code during installation. This can lead to unauthorized access, data exfiltration, and persistent malicious presence. All secrets and keys stored on the compromised system should be considered exposed and must be rotated from a secure environment. Simply removing the package does not guarantee removal of all malicious artifacts.

Remove the [email protected] package immediately from all affected systems. Rotate all secrets and keys that were stored or accessible on compromised machines from a different, secure system. Due to the potential for persistent compromise, consider full system reimaging or forensic analysis to ensure complete remediation. Monitor for any suspicious activity related to this package installation. Patch status is not applicable as this is a malicious package rather than a software vulnerability with an official fix.