@morpho-blue-liquidation-bot/liquidity-venues@2.0.0

Analysis

The package declares a dependency on itself resolved from the non-registry HTTP host pack[.]nppacks[.]com (hxxp://pack[.]nppacks[.]com/npm/@morpho-blue-liquidation-bot/liquidity-venues) in both dependencies and devDependencies. Installing the package causes npm to fetch the self-dependency from that external host over plain HTTP, meaning the code actually executed is served from a non-standard third-party registry rather than the npm registry. The package name impersonates the Morpho Blue DeFi protocol's liquidation-bot tooling.