optimize-regex@1.2.1

Analysis

Package optimize-regex@1.2.1 declares a self-referencing dependency via an external HTTP URL (hxxp://pack[.]nppacks[.]com/npm/optimize-regex) in both dependencies and devDependencies. The host pack[.]nppacks[.]com is a non-registry, non-standard server controlled by the attacker. When npm resolves this dependency, arbitrary code can be served from that URL and installed into the dependency tree. The shipped index.js is a decoy Babel plugin with no malicious runtime behavior; the attack vector is the external dependency declaration itself.