Malicious code in @checkrhq/adjudication-api-client (npm)

Source: amazon-inspector 8c52d9987ace09f0c48d8b0661bd1fcd3cf4e7e701b5e515810c7f32d99086cf package.json declares a preinstall lifecycle script that runs curl to POST installer reconnaissance data — hostname, current user whoami, working directory, and uid/gid id — to a hardcoded webhook.site...