@webda-infra/[email protected] is a near-empty package that depends on an untrusted package 'ltidisafe' fetched from a mutable Google Cloud Storage URL unrelated to the legitimate publisher. The package name and version are chosen to outrank legitimate internal packages, enabling dependency confusion or namespace squatting attacks. The mutable URL allows the attacker to change the payload at any time, including lifecycle scripts that run on install, effectively executing arbitrary code on the installer's machine. This results in a fully compromised system once the package is installed.

Any system that installs @webda-infra/[email protected] is at risk of full compromise due to arbitrary code execution during package installation. Attackers may gain complete control over the affected machine, potentially accessing all stored secrets and keys. The compromise is severe enough that removing the package alone does not guarantee eradication of malicious software introduced by the attacker.

There is no official patch or fix available for this malicious package. The recommended mitigation is to immediately remove @webda-infra/[email protected] from all systems. Additionally, all secrets and keys stored on affected machines should be rotated from a separate, uncompromised device. Exercise caution with packages that have unusual version numbers or dependencies pointing to unverified URLs. Monitor package sources carefully to avoid dependency confusion or namespace squatting attacks.