The npm package privacy-sdk@99.9.1 is a malicious package designed to deliver attacker-controlled code during installation. It acts as a hollow wrapper that fetches and installs a tarball from an untrusted Google Cloud Storage URL, bypassing npm's security mechanisms. This package uses a high version number to outrank legitimate internal packages, increasing the risk of dependency confusion attacks. Installing this package can fully compromise the host system, potentially exposing all stored secrets and keys.