transform-define@2.3.1

Analysis

Package publishes a dependency 'es' resolving to 'hxxp://npm[.]artifactsnpm[.]com/npm/transform-define' — an HTTP (non-HTTPS) external URL on a suspicious domain mimicking an official npm artifacts service. The published JavaScript code is a legitimate Babel plugin with no malicious behaviour of its own, but the dependency declaration points npm to an attacker-controlled registry. During install, npm would resolve 'es' from that URL, where a package with lifecycle hooks could execute arbitrary code. Several other declared dependencies (axios, node-fetch, ws) are unused in the published source and serve only to make the dependency tree look plausible. The package was freshly published at version 2.3. IOC: hxxp://npm[.]artifactsnpm[.]com — the attacker-registry host serving the 'es' dependency.