The 'oem-agentic-shared' npm package at version 99.9.1 is a hollow stub exporting an empty object and lacking legitimate functionality. Its installation pulls a single dependency from a direct HTTPS tarball URL hosted on a Google Cloud Storage bucket unrelated to the package name or known publisher CDNs. This off-registry tarball bypasses npm-registry scanning, allowing any lifecycle scripts within it to execute during 'npm install'. This technique is a known supply chain attack pattern designed to inject attacker-controlled, unscanned code into the dependency graph. The presence of this package on a system indicates a full compromise, with potential unauthorized control and data exposure.

Any computer with 'oem-agentic-shared' version 99.9.1 installed should be considered fully compromised. The malicious code can execute arbitrary commands during installation, potentially leading to unauthorized control over the system. All secrets and keys stored on the affected system are at risk and must be rotated immediately from a secure, uncompromised environment. Removing the package does not guarantee removal of all malicious artifacts or backdoors introduced by the attacker.

There is no official patch or fix available for this malicious package. Immediate removal of 'oem-agentic-shared' version 99.9.1 is recommended. However, because the system is likely fully compromised, all secrets and keys stored on the system should be rotated from a different, secure machine. Additional forensic analysis and system remediation may be necessary to ensure complete removal of malicious code and restore system integrity.