From the Super Mario Wiki
???? is a type of enemy found in Gwarhar Lagoon in Mario & Luigi: Superstar Saga. They can be a Sharkbone or what appears to be a Blurp with a shark fin attached to its back. These enemies always appear in groups that include both Sharkbones and Blurps, so it is impossible to tell which kind would attack until the very last moment of the creature's attack.
The name "Sharkbone" is actually based on unused enemy name text and appears as the undead shark's name in a Nintendo Power guide. This guide also erroneously refers to the Blurp-like fish as "Puffer-Cheep", which is a totally different Cheep Cheep form encountered underneath Oho Ocean in the Oho Ocean Seabed. Additionally, the German version of Mario and Luigi: Superstar Saga shows "Sand-Cheep" as the skeletal shark's name in coding, but never actually in-game.
"Blurp" ???? also make a brief appearance in Mario & Luigi: Partners in Time - they are used as projectiles of Shrooba Divers and bounce over the four heroes. The Junior Shrooboid is also referred to as ????. The Hermite Crab's shells and Antasma from Mario & Luigi: Dream Team are labeled as "????" in-game, but the name connection is coincidental.
The ???? has two attacks, depending on which type it is: Sharkbones burrow under and attack Mario or Luigi for large damage and possible Poison; the Blurp-like fish will jump right over Mario or Luigi, but if they jump, they will get hurt. ???? shuffle places each time one of them attacks, making it quite difficult to tell whether an attacker will be above or below Mario or Luigi. Therefore, the Mario Bros. could get hurt by a Blurp type, expecting it to be a Sharkbone, and vice-versa. The sharkbones stick their head out of the sand before attacking, while the Blurps provide no warning. However, when the brothers perform a regular Thunder Bros. attack on ????'s, and if at least one of them turns out to be a Sharkbone, the affected Sharkbones will immediately attack Mario and/or Luigi, one at a time.