transform-es2015-sticky-regex@6.24.3

Analysis

A dependency hijack via a self-referencing external URL. The package transform-es2015-sticky-regex (combosquat of the Babel transform plugin naming) declares a dependency and devDependency on itself at the URL hxxp://pack[.]nppacks[.]com/npm/transform-es2015-sticky-regex — a plain-HTTP attacker-controlled endpoint. When npm resolves the dependency graph, it fetches and installs code from that server, enabling the attacker to deliver arbitrary payloads to every install target. The shipped index.js contains a benign Babel plugin (red herring); the actual malicious delivery channel is the external URL dependency resolution at install time.