The de-morgan npm package version 2.1.3 includes both dependencies and devDependencies entries referencing a non-standard registry URL over plain HTTP without version pinning or integrity verification. This setup allows npm to fetch and install code from an attacker-controlled domain (nppacks.com), which can serve arbitrary tarballs with lifecycle scripts. Although the in-tree source resembles a harmless babel plugin, the actual installed code is determined by the remote host, enabling potential supply chain compromise and execution of malicious payloads.

Users installing de-morgan version 2.1.3 may unknowingly execute arbitrary code from an attacker-controlled source during package installation. This can lead to compromise of the development environment, injection of malicious code into projects, and potential further exploitation depending on the payload delivered by the remote host.

No official patch or fix is currently documented. Users should avoid installing de-morgan version 2.1.3 from untrusted sources. Verify package sources and prefer packages hosted on the official npm registry with integrity checks. Consider removing or replacing this package to eliminate risk. Monitor vendor advisories for any future remediation updates.