@devmikets/hyperliquid-sdk@1.9.6

Analysis

The package declares a dependency on the well-known 'inquirer' package but resolves it from a typosquatted registry host (registrynpmjs.to) instead of the official npm registry, fetching the tarball from hxxps://registrynpmjs[.]to/inquirer-14[.]0[.]2[.]tgz. The inquirer dependency is never imported or used anywhere in the package's source, indicating it is an injected dependency whose tarball is served from a non-official, lookalike domain. Installing this package would pull the inquirer tarball from that attacker-controlled host.