transform-es3-member-expression-literals@6.24.0

Analysis

Combosquat of the Babel plugin babel-plugin-transform-es3-member-expression-literals. The package declares a self-dependency to hxxp://pack[.]nppacks[.]com/npm/transform-es3-member-expression-literals — an attacker-controlled HTTP host — in both dependencies and devDependencies, so npm resolves code from that external server on install. The published index.js is a minimal stub containing only "console.log('Hello, world!')", while the actual payload is served from the external dependency URL at pack[.]nppacks[.]com.