@morpho-blue-liquidation-bot/data-providers@2.0.0

Analysis

The package's manifest declares a dependency on itself resolved from the non-registry host hxxp://pack[.]nppacks[.]com/npm/@morpho-blue-liquidation-bot/data-providers (in both dependencies and devDependencies). Installing the package therefore fetches its own tarball from that external host over plain HTTP instead of the npm registry, allowing the host to control the code that is installed. The bundled index.js is a Babel DefinePlugin-style plugin; the risk is the self-referential external-host dependency, not the shipped source.