GCVE-110-OSM-2026-10607

package.json declares both a `dependencies` and `devDependencies` entry for `de-morgan` pointing at `http://pack.nppacks.com/npm/de-morgan`, a non-npm-registry host reached over plain HTTP with no version pin or integrity check. On `npm install`, npm fetches and installs whatever tarball is served from that URL into the dependency graph, executing any lifecycle scripts it contains. The visible index.js is a clone of babel-plugin-transform-define and carries a top-of-file comment stating `This package use for Security Research Testing Purpose.`, but the shipped manifest wires in an attacker-controlled, mutable, plaintext delivery URL under a lookalike domain (`nppacks.com`), so the installed code path is whatever the remote host currently serves rather than the benign in-tree source. Judge assessment: This package is acting as a supply-chain loader for a mutable HTTP tarball from `http://pack.nppacks.com/npm/de-morgan`, which means the attacker model is a package publisher or compromised host serving arbitrary code into the install graph. The `package.json` URL-based dependency appears in both `dependencies` and `devDependencies`, and the analyzer explicitly classifies `pack.nppacks.com` as a loader with plaintext recovery, which bypasses registry integrity controls. The in-tree `index.js` reads like a benign Babel plugin clone with a security-research comment, but that does not negate the manifest-level delivery of remote code; on `npm install` the fetched tarball controls what actually executes. Combined with the publisher history tying `helenmagey` to `transform-es2015-unicode-regex` as a prior malicious package, this is consistent with a malicious supply-chain campaign rather than a false positive. ENTRY index.js (main: index.js) - URL-Based Dependency in package.json: ""dependencies": { "axios": "^1.7.9", "lodash": "^4.17.21", "node-fetch": "^3.3.2..." - URL Dependency Fetch Failed in package.json DESTINATION - 2 loader (urls, domains) (values recorded in verified_iocs) ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages