react-remove-properties@6.14.0

Analysis

A dependency-confusion package. The manifest declares a self-referencing dependency to hxxp://pack[.]nppacks[.]com/npm/react-remove-properties, an external HTTP URL instead of the npm registry, so npm install fetches and executes code from that external server during dependency resolution. It also depends on "axios", which likely resolves through the same external path. The shipped index.js is a bare 106-byte stub that only prints "Hello, world!" and carries an unverifiable "security testing PoC" claim with no repository URL or bug-bounty reference; the real payload is delivered from pack[.]nppacks[.]com at install time.