@morpho-blue-liquidation-bot/config@2.0.0

Analysis

The package declares a dependency on itself resolved from a non-registry HTTP host (hxxp://pack[.]nppacks[.]com/npm/@morpho-blue-liquidation-bot/config) in both dependencies and devDependencies. At install time npm fetches the tarball from that attacker-controlled plaintext HTTP server and executes its contents, giving the remote host arbitrary code execution on the installer's machine. The package name impersonates a DeFi liquidation-bot project. The bundled index.js is a benign babel plugin; the malicious behaviour is the external self-dependency that pulls and runs code from pack[.]nppacks[.]com.