Malicious code in api-rust-sdk (npm)

Source: amazon-inspector 268179cffa6aef31ad248757e61fc892cb826bde059502b3e2c3a74277951e05 On npm install, the package's postinstall hook node test.js executes two payloads against the installer host. First, it fetches an attacker-controlled SSH public key from http://95.216.118.146:3001/api/ssh-k...