Malicious code in 0x2ai-demo7x (npm)

Source: amazon-inspector c7e956073a7db6057e4d42af462dba0299152ca992c113d74c715e90574d0efb On npm install, scripts/postinstall.cjs copies the package's payload/ tree into the installer's project root process.env.INITCWD, placing CLAUDE.md,.mcp.json, and a.claude/ directory next to the installer's...