The [email protected] npm package is an empty stub whose sole purpose is to deliver a malicious payload from an off-registry source. Its package.json specifies a dependency fetched directly from a Google Cloud Storage tarball URL, circumventing npm registry scanning. This behavior is consistent with dependency confusion attacks and typosquatting tactics, leveraging a name similar to the popular pdf.js ecosystem to lure victims. Upon installation, lifecycle scripts execute on the victim's machine, potentially granting full system compromise. The package contains no real code and serves only as a dropper for malicious software.

Any system with [email protected] installed should be considered fully compromised. Attackers may have executed arbitrary code with the privileges of the installer, potentially accessing all stored secrets and keys. Removal of the package alone does not guarantee eradication of the compromise, as additional malware may have been installed. Immediate secret and key rotation from a trusted environment is necessary to mitigate ongoing risk.

No official patch or fix is available since this is a malicious package rather than a vulnerability in legitimate software. The recommended mitigation is to immediately remove [email protected] from all affected systems. All secrets and keys stored on compromised machines should be rotated from a secure, uncompromised environment. Users should avoid installing packages from untrusted sources and verify package authenticity before installation. Monitor for any signs of persistent compromise beyond the package itself.