@vault-v2-reallocation-bot/config@0.0.1

Analysis

The package manifest declares a dependency on its own package name resolved from a non-registry plain-HTTP host: dependencies["@vault-v2-reallocation-bot/config"] = "hxxp://pack[.]nppacks[.]com/npm/@vault-v2-reallocation-bot/config" (also in devDependencies). Installing the package redirects dependency resolution to that external host over unencrypted HTTP, allowing the host to serve arbitrary code as the dependency. The bundled index.js is a copy of the babel-plugin-transform-define Babel plugin; the supply-chain risk is the external self-dependency URL, not the shipped code.