The npm package '@fcsmc/commercial-analytics' version 99.9.1 is identified as malicious. It contains an inert stub but declares a dependency via a direct HTTPS tarball URL, which bypasses npm registry controls and installs attacker-controlled code. The package communicates with a domain linked to malicious activity. Installing this package can lead to full system compromise, and all secrets and keys on the affected system should be rotated immediately.