Malicious code in @carvana.authentication-flows/shared (npm)

Source: amazon-inspector 78538bf70d1ebd3e4cd784d90b3961ea7966ce9b97e8124110374cad95c0b894 package.json declares a preinstall hook node index.js that runs unconditionally on npm install. index.js imports childprocess/os/https, collects host identifiers os.hostname, os.userInfo, platform, arch,...