de-morgan@2.1.3

Analysis

The package declares a dependency on itself resolved from a non-registry HTTP URL (hxxp://pack[.]nppacks[.]com/npm/de-morgan). Installing it makes npm fetch the de-morgan tarball over plain HTTP from this third-party host instead of the npm registry, so whatever is served at that URL is installed and executed as part of the dependency tree. The bundled index.js is a Babel environment-variable replacement plugin with no payload of its own; the malicious vector is the dependency redirect to the non-registry host.