@riskine-frontend/[email protected] is a dependency confusion attack package that mimics an internal package by inflating its version number and providing minimal content. It depends on an external tarball hosted on Google Cloud Storage under a 'depenconf' folder, which is not from the official npm registry. Installing this package causes npm to fetch and execute code from this external source, potentially allowing attackers to execute arbitrary code on the installer's machine. This package is a clear example of attacker tradecraft targeting internal build systems via dependency confusion.

Systems that have installed or run this package are considered fully compromised. Attackers may have gained full control over the affected machines, potentially accessing all stored secrets and keys. The presence of this package indicates a successful dependency confusion attack, which can lead to arbitrary code execution and persistent malicious presence. Simply removing the package does not guarantee removal of all malicious artifacts or backdoors.

There is no official patch or fix available for this malicious package. Immediate removal of @riskine-frontend/[email protected] is required. All secrets and keys on affected systems must be rotated from a secure, uncompromised environment. Due to the high likelihood of full system compromise, a thorough incident response and forensic analysis should be conducted. Monitor internal package naming and versioning policies to prevent dependency confusion attacks. Consider implementing strict package source verification and use of private registries to mitigate similar threats.