Typosquatt alert Malicious NPM Package: NYC-config

We discovered a malicious npm package nyc-config using our malicious OSS package monitor. It involved sending user system data to external domains.

Initially we assumed it to be a possible dependency confusion attack against @istanbuljs/load-nyc-config with ~25M weekly downloads. However, we were unable to identify corroborating evidences after manually analysing the entire dependency tree of nyc and load-nyc-config package.

We finally concluded it to be a possible typosquatt attack against the widely adopted @istanbuljs/load-nyc-config.