The privacy-sdk package version 99.9.1 on npm is a hollow wrapper with no legitimate functionality. Its sole runtime dependency is a tarball fetched directly from an untrusted Google Cloud Storage bucket URL, which bypasses npm's registry publication, audit, and integrity verification processes. This tarball is mutable by whoever controls the bucket, allowing arbitrary code execution during npm install lifecycle scripts. The package uses a canonical high version number to outrank internal packages, facilitating dependency confusion attacks. The package's installation results in attacker-controlled code execution, fully compromising the host environment.

Any system with [email protected] installed or running should be considered fully compromised. Attackers may have executed arbitrary code with full control over the system. All secrets and keys stored on the compromised system are at risk and must be rotated immediately from a secure environment. Removing the package alone does not guarantee removal of all malicious software or backdoors introduced during installation.

Immediate removal of the [email protected] package is recommended. All secrets and credentials stored on the affected system should be rotated from a different, uncompromised machine. Due to the potential full system compromise, a complete system rebuild or forensic analysis may be necessary. There is no official patch or fix for this malicious package; prevention relies on avoiding installation of untrusted or suspicious packages and verifying package sources and integrity.