Malicious code in log-rotate-testmetest (npm)

Source: amazon-inspector 8608133ab1a2f106c095f84116cd25fa141208dbf81ea6fe2331e38a88551a4b The package ships a binding.gyp whose sources field uses GYP command-expansion !env node index.js... with no native source files, causing npm's implicit node-gyp rebuild to execute index.js at install time...