The @webda-features/dashboard npm package (version 99.9.1) is a malicious package designed to deliver arbitrary code by resolving a dependency from an external HTTPS tarball hosted on an unverified Google Cloud Storage bucket. The package itself contains only an empty module export but triggers npm to fetch and install the external tarball during installation, which can execute lifecycle scripts and malicious code outside the npm registry's audit scope. The package name mimics the legitimate @webda scope and uses an inflated version number to facilitate dependency confusion attacks targeting private @webda-features/* resolutions. Installation of this package leads to full compromise of the affected system.

Any system with @webda-features/dashboard version 99.9.1 installed is considered fully compromised. Attackers may gain full control over the system, potentially accessing all stored secrets and keys. Removal of the package alone does not guarantee eradication of the malicious code or backdoors introduced. Immediate secret and key rotation from a separate, uncompromised system is required to mitigate ongoing risk.

Remove the @webda-features/dashboard package version 99.9.1 immediately from all affected systems. Consider all systems with this package installed as fully compromised and perform secret and key rotation from a clean environment. Since no official fix or patch is available, avoid installing this package or any similarly named packages from unverified sources. Monitor package dependencies carefully to prevent dependency confusion attacks.