papika-fetcher@1.0.1

Analysis

papika-fetcher@1.0.1 declares a circular self-dependency (papika-fetcher:^1.0.0) that disrupts normal npm install. Its main.js fetches remote JavaScript from raw[.]githubusercontent[.]com/AD-CHII/TrueCHII-GIFT/main/index.js, writes it locally, and then require()s it to load and execute the fetched code. There are no lifecycle hooks, so the code runs only when explicitly called, but the self-dependency plus remote-code fetch-and-execute is a clear supply-chain attack pattern.