cobo-ui-toolkit@1.0.5

Analysis

Package declares a self-dependency resolved from an attacker-controlled HTTP server (hxxp://pack[.]nppacks[.]com/npm/cobo-ui-toolkit) instead of the npm registry. When installed, npm fetches the dependency from this external URL, allowing the attacker to serve arbitrary code at install time. The shipped index.js is a verbatim copy of the legitimate babel-plugin-transform-define library, serving as camouflage. The package name combosquats Cobo, a cryptocurrency custody platform, targeting crypto developers.