Malicious code in @onescience/onecode (npm)

Source: amazon-inspector d334dd52244b44793af06be86dfd8d0de20ea8bb6d28cc1e4016b5fa45432578 The postinstall lifecycle script runs ensurePlatformBinary, which when the optionalDependency install fails to populate the platform package falls back to fetching a.tgz over HTTPS from a hardcoded bare-IP...