The 'wm-mapper' npm package at version 99.9.1 is a malicious package designed to perform a dependency confusion attack. It is published at an artificially high version number and contains minimal code itself, instead relying on a runtime dependency fetched directly from an unvetted, mutable Google Cloud Storage tarball URL. This allows arbitrary attacker-controlled code to be introduced into the install environment during npm install lifecycle scripts. The package's communication with known malicious domains further confirms its malicious intent. This package effectively compromises any system where it is installed.

Systems with 'wm-mapper' version 99.9.1 installed are fully compromised, as the package pulls and executes arbitrary attacker-controlled code. This may lead to unauthorized access, data theft, and persistent malicious control. All secrets and keys on affected systems should be considered exposed and require immediate rotation from a secure environment. Removal of the package alone does not guarantee eradication of all malicious artifacts.

No official patch or fix is available for this malicious package. The recommended mitigation is to immediately remove 'wm-mapper' version 99.9.1 from all systems. Rotate all secrets and keys that may have been exposed, performing this from a different, uncompromised system. Monitor for any signs of persistent compromise and rebuild affected systems if necessary. Avoid installing packages from untrusted sources or those that declare dependencies via direct URLs to unvetted storage.