de-morgan @2.1.3

Summary

package.json declares both a dependencies and devDependencies entry for de-morgan pointing at http://pack.nppacks.com/npm/de-morgan , a non-npm-registry host reached over plain HTTP with no version pin or integrity check. On npm install , npm fetches and installs whatever tarball is served from that URL into the dependency graph, executing any lifecycle scripts it contains. The visible index.js is a clone of babel-plugin-transform-define and carries a top-of-file comment stating This package use for Security Research Testing Purpose. , but the shipped manifest wires in an attacker-controlled, mutable, plaintext delivery URL under a lookalike domain ( nppacks.com ), so the installed code path is whatever the remote host currently serves rather than the benign in-tree source.

Source: amazon-inspector (93cdcef4435e4bbb8f5841076c9294b934eaebd268286204a37cab9c334a045f)