transform-es2015-destructuring@6.24.1

Analysis

Package combosquats a real Babel plugin. The package's manifest declares a self-dependency resolved from an external HTTP server (pack[.]nppacks[.]com) instead of the npm registry. When npm installs this package, it fetches and executes code from the attacker-controlled host, which can serve arbitrary malicious payloads with install-time lifecycle hooks. The package's own code is a 106-byte decoy that prints "Hello, world!" and has no real functionality.