de-morgan

Details

**Severity:** Critical

**Affected versions:** `= 2.1.3`

## Source: amazon-inspector (93cdcef4435e4bbb8f5841076c9294b934eaebd268286204a37cab9c334a045f)
package.json declares both a `dependencies` and `devDependencies` entry for `de-morgan` pointing at `http://pack.nppacks.com/npm/de-morgan`, a non-npm-registry host reached over plain HTTP with no version pin or integrity check. On `npm install`, npm fetches and installs whatever tarball is served from that URL into the dependency graph, executing any lifecycle scripts it contains. The visible index.js is a clone of babel-plugin-transform-define and carries a top-of-file comment stating `This package use for Security Research Testing Purpose.`, but the shipped manifest wires in an attacker-controlled, mutable, plaintext delivery URL under a lookalike domain (`nppacks.com`), so the installed code path is whatever the remote host currently serves rather than the benign in-tree source.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/635deadcfcae932654619da7f1725f0d1fa21247/osv/malicious/npm/de-morgan/MAL-2026-14264.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/635deadcfcae932654619da7f1725f0d1fa21247/osv/malicious/npm/de-morgan/MAL-2026-14264.json
- https://www.npmjs.com/package/de-morgan/v/2.1.3
- https://github.com/ossf/malicious-packages/blob/78792aee23e5c759f309a3d2e9397caf2439773e/osv/malicious/npm/de-morgan/MAL-2026-14264.json
- https://github.com/advisories/GHSA-q86w-28ph-gmvv

Compromised versions (1)

• = 2.1.3

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.