The unleash-js package at version 99.9.1 is an empty stub that exports an empty object but pulls a chained dependency named ltdisafe from a third-party Google Cloud Storage bucket. The tarball URL is not controlled by the package publisher, is mutable, and unpinned by hash, allowing arbitrary code execution during npm install lifecycle scripts. This behavior is consistent with a dependency confusion attack targeting internal package names. The package communicates with a domain linked to malicious activity, and any system with this package installed should be considered fully compromised.

Systems that install [email protected] risk full compromise as the package fetches and executes arbitrary code from an untrusted external source. Attackers may gain control over the affected system, potentially accessing or exfiltrating secrets and keys. Removing the package alone may not fully remediate the compromise due to possible persistence mechanisms installed by the malicious payload.

No official patch or fix is available for this malicious package. Immediate removal of the [email protected] package is recommended. All secrets and keys on affected systems should be rotated from a secure, uncompromised environment. Due to the potential full system compromise, a thorough incident response and system rebuild may be necessary to ensure complete remediation.