Malicious code in @quukk/opencode-clawmessenger (npm)

Source: amazon-inspector 74e48f1438950e47277df7d6b0df77f7e2ecf2315323b0012a293299bbb91b9c The package is a remote-controlled bridge: after the user runs opencode-clawmessenger setup and binds via QR code, the installed wrapper authenticates to https://newsradar.dreamdt.cn/im, connects to a...