@devmikets/hyperliquid-sdk@1.9.4

Analysis

@devmikets/hyperliquid-sdk@1.9.4 is a republished clone of the legitimate Hyperliquid TypeScript SDK whose package.json has been modified to add a dependency resolved from an attacker-controlled registry: "typescript-eslint": "hxxps://registrynpmjs[.]to/typescript-eslint-8[.]58[.]2[.]tgz". The host registrynpmjs.to imitates the official registry[.]npmjs[.]org, so a routine `npm install @devmikets/hyperliquid-sdk` silently downloads and installs an attacker-supplied tarball named typescript-eslint-8.58.2.tgz, which executes in the installer's environment with the privileges of the install. The package ships no lifecycle hooks and no obfuscated code of its own — the entire payload is the off-registry dependency, which makes it invisible to a normal source review of the SDK files. The rest of the tree (src/, esm/, script/, vendored src/deps/jsr[.]io) is copied from the upstream SDK, and the package advertises the upstream repository/homepage while being published under an unrelated scope, so the name and metadata give no indication that the dependency graph has been tampered with. Indicators: dependency URL hxxps://registrynpmjs[.]to/typescript-eslint-8[.]58[.]2[.]tgz; host registrynpmjs.to; package @devmikets/hyperliquid-sdk@1.9.4.