The sorenson-webfonts package at version 99.9.1 is a hollow package with minimal code and placeholder metadata, exhibiting characteristics of a dependency confusion attack. It fetches and executes an off-registry tarball from a Google Cloud Storage bucket path named 'depenconf', which is not subject to npm registry integrity checks or review. The package name does not correspond to its functionality, and it communicates with domains associated with malicious activity. This behavior indicates it is a smuggling vehicle for malicious code rather than a legitimate library. The OpenSSF Package Analysis and other sources classify it as malicious, warning that any system with this package installed should be considered fully compromised.

Systems with [email protected] installed are at risk of full compromise due to execution of untrusted code from an off-registry source. Attackers may gain complete control over the affected system, potentially accessing all stored secrets and keys. Removal of the package alone may not fully remediate the compromise, necessitating secret and key rotation from a secure environment.

Remove the sorenson-webfonts package version 99.9.1 immediately if installed. Rotate all secrets and keys stored on the affected system from a different, trusted computer. Because full system compromise is possible, consider a full system audit and remediation. There is no official patch or fix; avoidance and removal are the primary mitigations.