@pump-fun-skills/coin-fees@1.0.0

Analysis

The package declares a dependency on itself resolved from a non-registry external host (hxxp://pack[.]nppacks[.]com/npm/@pump-fun-skills/coin-fees) in both dependencies and devDependencies. Installing the package causes npm to fetch a tarball from that external host, which is attacker-controllable and can substitute a malicious payload. The bundled code is a Babel plugin for inlining environment variables; the supply-chain risk is the external-host self-dependency in the manifest.