The npm package css-grid-snap-util versions 1.0.0 and 1.0.1 contains a stub module and a manifest referencing a webhook.site endpoint. Although the package code does not currently execute outbound network behavior, it is identified as a malicious package. Systems with this package installed should be considered fully compromised, and all secrets and keys on those systems should be rotated immediately. Removal of the package alone may not eliminate all malicious software.