Malicious code in @umschool/analytics (npm)

Source: amazon-inspector 7ce44bf9d1ffcc0a63fbc4e955c97cbd45f928e90ba052c49d4cce211b7fed96 @umschool/[email protected] ships a postinstall.js that runs automatically on npm install. The script collects os.hostname, os.userInfo.username, os.platform, process.cwd, and process.version, base64-encodes...