The npm package @webda-infra/search version 99.9.1 is a malicious placeholder designed to execute arbitrary code during installation. It declares a dependency on a package hosted on an unverified Google Cloud Storage URL, allowing the attacker to serve any code, including install scripts, to the victim. Installing this package can lead to full system compromise. Immediate removal and secret/key rotation are strongly advised.