@morpho-blue-reallocation-bot/client@2.0.0

Analysis

The package manifest declares a dependency on itself resolved from a non-registry HTTP host (hxxp://pack[.]nppacks[.]com/npm/@morpho-blue-reallocation-bot/client) in both dependencies and devDependencies. Installing the package causes npm to fetch and execute code from that external plain-HTTP host, which is attacker-controlled and can serve arbitrary code at install time. The bundled index.js is a benign Babel plugin; the malicious behaviour is the manifest's external-URL dependency resolution.