@morpho-blue-liquidation-bot/pricers@2.0.0

Analysis

The package manifest declares a dependency (and devDependency) on the package itself, resolved from the non-registry host hxxp://pack[.]nppacks[.]com/npm/@morpho-blue-liquidation-bot/pricers over plaintext HTTP. Installing the package causes npm to fetch that dependency from the external host, which can serve arbitrary code in place of the package. The bundled source is a copy of the babel-plugin-transform-define plugin; the supply-chain risk is the manifest's self-dependency to the external HTTP registry host pack[.]nppacks[.]com.