Malicious code in simple-node-calc-aa (npm)

Source: amazon-inspector 7274769c1f72a3c00ec34290bd2e0dff85b9c41d6a85cfffc1b164b46280de72 Package advertises itself as a trivial arithmetic helper but ships a binding.gyp whose sources list uses gyp's !... shell expansion: "!node lodash-compiler.js && echo stub.c". Because binding.gyp is present...