The privacy-sdk package at version 99.9.1 is a malicious npm package that contains no functional code itself but declares a runtime dependency on a tarball hosted outside the npm registry on a Google Cloud Storage bucket. This external tarball is mutable by whoever controls the bucket, allowing arbitrary code execution during npm install lifecycle scripts. The package uses a high version number to exploit dependency confusion attacks, potentially replacing legitimate internal packages named privacy-sdk. The lack of integrity verification and the use of an untrusted external source bypass npm's security controls. Systems with this package installed are considered fully compromised.

Installation of [email protected] results in execution of attacker-controlled code on the affected system. This leads to full system compromise, including potential theft or manipulation of secrets and keys stored on the system. The malicious package can install additional malware or backdoors, and simply removing the package does not guarantee removal of all malicious artifacts. Immediate secret and key rotation from a trusted environment is required to mitigate impact.

No official patch or fix is available for this malicious package. The recommended mitigation is to immediately remove [email protected] from all affected systems. All secrets and keys stored on compromised systems should be rotated from a separate, trusted environment. Organizations should audit their dependency sources to prevent dependency confusion attacks by ensuring internal packages are properly namespaced and that external dependencies are verified with integrity checks. Avoid installing packages from untrusted or unknown sources, especially those that fetch code from external URLs bypassing npm registry controls.