The @webd-infra/query-designer-domain package at version 99.9.1 is a malicious npm package that uses a direct tarball URL dependency to an untrusted Google Cloud Storage bucket. This setup bypasses npm registry controls, enabling execution of arbitrary lifecycle scripts from the tarball, which can be changed at any time by the bucket owner. The package has no legitimate runtime code and serves solely to execute this off-registry code. Due to this behavior, any system with this package installed should be considered fully compromised.

Systems with this package installed are fully compromised, as the malicious tarball can execute arbitrary code with the privileges of the installing user. All secrets and keys on the compromised system are at risk and must be rotated. Removal of the package alone may not eliminate all malicious software introduced during installation.

Remove the @webd-infra/query-designer-domain package version 99.9.1 immediately. Rotate all secrets and keys from a separate, uncompromised system. Because full system compromise is likely, assume persistent malicious presence and perform a thorough incident response. No official patch or fix is available; remediation relies on removal and secret rotation.