no-for-of-loops@1.0.1

Analysis

Package declares a self-referencing dependency via an attacker-controlled HTTP URL (hxxp://pack[.]nppacks[.]com/npm/no-for-of-loops) in both dependencies and devDependencies. On npm install, the package manager fetches the tarball from this non-registry host, allowing the attacker to serve arbitrary malicious code at install time. The HTTP protocol also enables man-in-the-middle tampering. The package's own source code is a benign Babel plugin for compile-time constant replacement, but the manifest hijacks dependency resolution to an external attacker-controlled endpoint.