transform-es2015-typeof-symbol@6.24.1

Analysis

Package transform-es2015-typeof-symbol@6.24.1 declares a dependency on itself resolving to the non-registry host hxxp://pack[.]nppacks[.]com/npm/transform-es2015-typeof-symbol, causing npm install to fetch arbitrary code from that external server. It also depends on known typosquatted package axios (not the legitimate axios package). Together these create a dependency-confusion/manifest-pollution attack chain where the attacker serves payloads from pack[.]nppacks[.]com during install resolution.