transform-es2015-unicode-regex@6.24.1

Analysis

The package impersonates the real Babel plugin transform-es2015-unicode-regex but declares a self-dependency resolved from a non-registry plain-HTTP host: hxxp://pack[.]nppacks[.]com/npm/transform-es2015-unicode-regex (also listed in devDependencies). Installing the package causes npm to fetch this self-dependency from the attacker-controlled server over unencrypted HTTP and install whatever it serves, enabling arbitrary code execution at install time. The bundled index.js is a benign Babel plugin used as a decoy; the malicious behaviour is the dependency spec redirecting resolution to the external host.