[email protected] is an empty npm package whose sole runtime dependency is an HTTPS tarball URL pointing to a third-party Google Cloud Storage bucket. This bucket is not part of the npm registry, is mutable, and not pinned by hash, allowing the attacker to control the code executed during npm install lifecycle scripts. The package name and version are crafted to out-rank internal packages in mixed-resolution environments, a classic dependency confusion attack. The package itself exports an empty object and contributes no functionality other than sideloading malicious code from attacker-controlled infrastructure.

Installing [email protected] results in execution of attacker-controlled code on the victim system, leading to full compromise. Attackers may gain complete control, access all stored secrets and keys, and persist malicious software. Removal of the package alone does not guarantee eradication of the compromise. Immediate secret rotation from a separate, uncompromised system is required.

Remove the [email protected] package immediately. Consider any system with this package installed fully compromised and rotate all secrets and keys from a different, secure computer. Due to the nature of the compromise, further forensic analysis and remediation may be necessary. Avoid installing packages from untrusted or suspicious sources, especially those with unusual versioning or external dependencies hosted outside official registries. Monitor for similar dependency confusion attempts in your environment.