Malicious code in chapters-core (npm)

Source: amazon-inspector e24d8bd29ee6c23e0f394b68bbc5b580614da4479a2462c10d61387da464b992 The package registers preinstall/postinstall lifecycle scripts that execute poc.js on npm install. poc.js collects os.hostname, os.userInfo.username, process.cwd, and CI/CD attribution environment variables...