The 'gunzip-js' npm package at version 99.9.1 is identified as malicious due to its design as a typosquatting package mimicking legitimate 'gunzip' packages. Instead of using a standard npm registry dependency, it declares a dependency on an external HTTPS tarball hosted on an anonymous Google Cloud Storage bucket. This external dependency is not audited or verified and may contain attacker-controlled code. The package's own code is effectively empty, with the sole purpose of pulling and executing code from this external source during installation lifecycle scripts. The bucket path includes the term 'depenconf', indicating a dependency confusion attack vector. The package communicates with domains associated with malicious activity, confirming its threat nature.

Installing 'gunzip-js' version 99.9.1 results in the execution of attacker-controlled code on the system due to the external dependency fetched from an unaudited and anonymous cloud storage bucket. This can lead to arbitrary code execution within the context of the npm install process, potentially compromising the development environment or build pipelines that include this package.

No official patch or fix is available since this is a malicious package rather than a vulnerability in legitimate software. The recommended mitigation is to avoid installing 'gunzip-js' version 99.9.1 and to audit dependencies carefully to detect and exclude typosquatting or malicious packages. Use trusted package sources and verify dependencies before installation. Consider using tools that detect malicious or suspicious packages in the supply chain.