transform-object-assign@6.22.0

Analysis

Package transform-object-assign@6.22.0 resolves its dependency "ui-styles-pkg" over plain HTTP from hxxp://package[.]storeartifacts[.]com/npm/transform-object-assign — a non-standard, non-npm host with no TLS and no integrity verification. Any code fetched from that URL executes as part of the install dependency chain, giving the external server full control over the dependency's behaviour when the package is required.