The npm package @webda-features/dashboard version 99.9.1 is a malicious package that acts as an empty wrapper but installs a dependency from an untrusted external Google Cloud Storage URL. This external tarball can contain arbitrary code, leading to full system compromise upon installation. The package name mimics a legitimate scope to facilitate dependency confusion attacks. Systems with this package installed should be considered fully compromised, and all secrets and keys must be rotated from a clean environment.