The npm package @webd-infra/query-designer-domain version 99.9.1 is identified as malicious. It declares a dependency on an off-registry tarball hosted on a Google Cloud Storage bucket, allowing the bucket owner to execute arbitrary code during installation. The package itself contains no runtime code other than resolving and executing this external tarball. Installation of this package can lead to full system compromise, requiring immediate secret and key rotation and package removal.