We discovered a malicious npm package nyc-config using our malicious OSS package monitor. It involved sending user system data to external domains. Initially w

We discovered a malicious npm package nyc-config using our malicious OSS package monitor. It involved sending user system data to external domains. Initially we assumed it to be a possible dependency confusion attack against @istanbuljs/load-nyc-config with ~25M weekly downloads. However, we were unable to identify corroborating evidences after manually analysing the entire dependency tree of nyc and load-nyc-config package. We finally concluded it to be a possible typosquatt attack against the widely adopted @istanbuljs/load-nyc-config.