Malicious code in @7nohe/openapi-react-query-codegen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab8f8efdad9084d2a7c5ae5058ffc18886d68bfe1c676239fd7e0d41342fc700 The tarball ships a binding.gyp at the package root whose conditions field abuses GYP's Python expression evaluator to walk .class.base.subclasses to...

Malicious code in lodahs-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15cec128c194761de8cd73923062ece7e4104b5e6130ca40882c5ac9d3f83914 The postinstall lifecycle script in scripts/postinstall.js executes automatically on npm install and performs three attacker-benefiting actions. Firs...